Symfony Authentication: What's next? (SymfonyCon Vienna 2024)

Symfony Authentication: What's next?
The Security component has changed a lot in the past few years.
From Authentication Listeners to Guard and finally the Authenticator Manager system, Symfony now has the most robust infrastructure ever to support most if not all modern, industry-standard Security protocols.

The community started building on these new foundations by introducing an AccessTokenAuthenticator and kept improving it since then, notably through adding more token handlers for well-known authentication protocols.
That's pretty cool already, but what should we expect next? How far will we take it?

In this talk, I'm going to put my Security maintainer hat on to answer these questions and share some insights about what's going on in this critical part of our beloved framework.

Transcript

1. Symfony Authentication What’s Next?
2. Robin Chalas github.com/chalasr chalasr.bsky.social x.com/chalas_r PHP Consultant / Symfony Core Team / baksla.sh Co-founder
3. How it started
4. Authentication Listeners
5. Somewhat Flexible Very Complicated
6. Guard Authenticators Thanks Ryan 🧡
7. Much simpler, more flexible.
9. Authentication system does not play well with modern authentication flows. Problem
10. How about login by email?
11. Fixed.
12. How about passwordless? e.g. login links
13. Fixed.
14. Time to revisit authenticators.
15. 👋 Authenticator Manager New event-based authenticator system. Simplified API with improved foundations. Thanks Wouter 💚
16. Cool. What’s Next?
17. People need stateless, token-based authentication for complex systems.
18. Bearer Authenticator
19. OpenID Connect
20. CAS 2.0
21. Stateless CSRF Protection
22. Upcoming features
23. Built-in Stateless Logout
24. OAuth2 Token Introspection
25. OIDC Discovery
26. OIDC Token Encryption
27. Goodbye eraseCredentials()
28. European commission cuts $27 Million of Free Software’s 2025 budget. No more EU-sponsored hackday anytime soon :/ Bad news https://fsfe.org/news/2024/news-20240911-01.en.html
29. Tidelift cuts 50% of PHP projects’ base-level funding. Bad news
30. The Symfony Core Team needs time & strength to move forward contributions.
31. You can help! Good news https://symfony.com/doc/current/contributing/code/core_team.html https://symfony.com/sponsor https://github.com/sponsors/chalasr https://opensourcepledge.com
32. Danke 🍻