How to Write a Custom Authenticator

Symfony comes with:ref:`many authenticators<security-authenticators>` and

third party bundles also implement more complex cases like JWT and oAuth

2.0. However, sometimes you need to implement a custom authentication

mechanism that doesn't exist yet or you need to customize one. In such

cases, you can use the ``make:security:custom`` command to create your own

authenticator.

Authenticators should implement the

:class:`Symfony\\Component\\Security\\Http\\Authenticator\\AuthenticatorInterface`.

You can also extend

:class:`Symfony\\Component\\Security\\Http\\Authenticator\\AbstractAuthenticator`,

which has a default implementation for the ``createToken()``

method that fits most use-cases::

Symfony comes with:ref:`many authenticators<security-authenticators>`, and

third-party bundles also implement more complex cases like JWT and OAuth 2.0.

However, sometimes you need to implement a custom authentication mechanism

that doesn't exist yet, or you need to customize an existing one.

To save time, you can install `Symfony Maker`_ and let Symfony generate a new

authenticator by running the following command:

..code-block::terminal

Open the ``src/Security/ApiKeyAuthenticator.php`` file created by this command,

and you'll find something like the following::

Authenticators must implement the

:class:`Symfony\\Component\\Security\\Http\\Authenticator\\AuthenticatorInterface`.

You can also extend

:class:`Symfony\\Component\\Security\\Http\\Authenticator\\AbstractAuthenticator`,

which provides a default implementation of the ``createToken()`` method suitable

for most use cases.

..tip::

If your custom authenticator is a login form,you can extend from the

If your custom authenticator is a login form,consider extending

:class:`Symfony\\Component\\Security\\Http\\Authenticator\\AbstractLoginFormAuthenticator`

class insteadtomake yourjob easier.

tosimplify yourimplementation.

The authenticator can be enabled using the ``custom_authenticators`` setting:

Custom authenticators must be explicitly enabled in the security configuration

using the ``custom_authenticators`` setting of your firewall(s). If you used the

``make:security:custom`` command, this configuration is already updated, but you

should review it:

..configuration-block::

.. _`Symfony Maker`:https://symfony.com/doc/current/bundles/SymfonyMakerBundle/index.html

.. _`session storage flooding`:https://symfony.com/blog/cve-2016-4423-large-username-storage-in-session