Symfony Security Core

The Symfony Security Core component provides an infrastructure for sophisticated authorization systems, making it possible to easily separate the actual authorization logic from so-called user providers that hold the users’ credentials. It supplies the tokens, voters, access decision manager, and role hierarchy that decide whether a given user may perform an action.

Security Core also includes user abstractions and providers, password hashing integration, authentication trust resolution, and expression-based access rules. As the foundation of Symfony’s security stack, it can be used standalone to add robust authentication and authorization to any PHP application.

What You Get

• An AccessDecisionManager and Voter interface for pluggable, composable authorization decisions
• Built-in voters including RoleVoter, RoleHierarchyVoter, and AuthenticatedVoter
• User abstractions (UserInterface, PasswordAuthenticatedUserInterface) and in-memory or custom user providers
• Authentication tokens and a trust resolver distinguishing anonymous, remember-me, and fully authenticated states
• Role hierarchy expansion, password hashing integration, and expression-based access control

Common Use Cases

• Deciding whether the current user is authorized to perform an action or access a resource
• Enforcing role-based access control with hierarchical roles
• Loading and refreshing users from a custom user provider decoupled from credential storage
• Writing custom voters or expression-based rules for fine-grained authorization

Under The Hood

Architecture - The component is layered into Authentication/ (tokens such as UsernamePasswordToken and the AuthenticationTrustResolver), Authorization/ (AccessDecisionManager plus the Voter interface and RoleVoter, RoleHierarchyVoter, AuthenticatedVoter implementations), Role/ (RoleHierarchy expansion), and User/ (UserInterface, providers, and password-hasher integration). The AccessDecisionManager combines voter verdicts under a configurable strategy while user providers stay decoupled from credential storage.

Tech Stack - Pure PHP under the Symfony\Component\Security\Core namespace with PSR-4 autoloading, optionally integrating symfony/expression-language for expression-based rules and the password-hasher and event-dispatcher contracts. It is distributed as a read-only subtree split of the symfony/symfony monorepo.

Code Quality - The repository ships a thorough PHPUnit suite under Tests/ covering tokens, voters, the decision manager, role hierarchy, and user providers, plus a Test/ namespace of helpers, and follows Symfony’s strict coding standards and backward-compatibility promise, appropriate for security-critical code.

API Design - The core abstractions, decide() on the AccessDecisionManager and the single-method Voter interface, are clean and easy to extend, as the README’s AccessDecisionManager example shows. Because security spans authentication tokens, providers, voters, and role hierarchies, the full surface has a steeper learning curve, well supported by Symfony’s security documentation.