Firewall
A named, path-matched set of authenticators plus the entry point that handles a failed authentication attempt for that path — the runtime counterpart of a security.xml <firewall> element.
Synopsis
Section titled “Synopsis”final class Firewall
| Since | 1.0.0 |
| Source | Firewall.php |
Constructor
Section titled “Constructor”__construct()
Section titled “__construct()”public function __construct(string $name, string $pattern, array<AuthenticatorInterface> $authenticators, EntryPointInterface $entryPoint, bool $stateless = false, bool $sessionless = false): mixed
Session axis: no session is started at all for requests under this firewall.
| Parameter | Type | Description |
|---|---|---|
$name | string | A diagnostic name for this firewall (e.g. “api”, “main”). |
$pattern | string | A PCRE pattern (without delimiters) matched against the request path. |
$authenticators | array``<AuthenticatorInterface> | Tried in order; the first one whose supports() matches wins. |
$entryPoint | EntryPointInterface | Produces the failure response when authentication is required but absent/invalid. |
$stateless | bool | Identity axis: re-derived from the credential every request rather than read back from the session. |
$sessionless | bool | Session axis: no session is started at all for requests under this firewall. |
Returns mixed
Methods
Section titled “Methods”| Method | Description |
|---|---|
canonicalize(string $path): string | Collapse a request path to the form a filesystem-style resolver would reach: fully percent-decoded, backslashes treated as separators, duplicate slashes collapsed, and ./.. segments resolved. |
getAuthenticators(): array<AuthenticatorInterface> | |
getEntryPoint(): EntryPointInterface | |
getName(): string | |
isSessionless(): bool | Session axis: no session is started at all for requests under this firewall (pure machine-to-machine surfaces). |
isStateless(): bool | Identity axis: re-derived from the credential every request rather than read back from the session as the source of truth. |
matches(string $path): bool | Whether $path falls under this firewall. |
canonicalize()
Section titled “canonicalize()”public static function canonicalize(string $path): string
Collapse a request path to the form a filesystem-style resolver would reach: fully percent-decoded, backslashes treated as separators, duplicate slashes collapsed, and ./.. segments resolved.
The raw request path.
| Parameter | Type | Description |
|---|---|---|
$path | string | The raw request path. |
Returns string — The normalized path, always starting with /.
getAuthenticators()
Section titled “getAuthenticators()”public function getAuthenticators(): array<AuthenticatorInterface>
Returns array``<AuthenticatorInterface> — This firewall’s authenticator chain, in try order.
getEntryPoint()
Section titled “getEntryPoint()”public function getEntryPoint(): EntryPointInterface
Returns EntryPointInterface — The entry point for a failed authentication attempt on this firewall.
getName()
Section titled “getName()”public function getName(): string
Returns string — This firewall’s diagnostic name.
isSessionless()
Section titled “isSessionless()”public function isSessionless(): bool
Session axis: no session is started at all for requests under this firewall (pure machine-to-machine surfaces).
Returns bool — True if this firewall is sessionless, otherwise false.
isStateless()
Section titled “isStateless()”public function isStateless(): bool
Identity axis: re-derived from the credential every request rather than read back from the session as the source of truth.
Returns bool — True if this firewall is stateless, otherwise false.
matches()
Section titled “matches()”public function matches(string $path): bool
Whether $path falls under this firewall.
The request path to test (e.g. $request->getUri()->getPath()).
| Parameter | Type | Description |
|---|---|---|
$path | string | The request path to test (e.g. $request->getUri()->getPath()). |
Returns bool — True if $path matches this firewall’s pattern, otherwise false.