I'm trying to create REST API with JWT authentification in Symfony5. At first I've tried to do as written here https://h-benkachoud.medium.com/symfony-rest-api-without-fosrestbundle-using-jwt-authentication-part-2-be394d0924dd . Difficulties appeared when I've tried to make method getTokenUser:
/** * @param JWTTokenManagerInterface $JWTManager * @return JsonResponse * @Route("/api/login_check", name="api_login_check", methods={"POST"}) */ public function getTokenUser(UserInterface $user,JWTTokenManagerInterface $JWTManager) { return new JsonResponse(['token' => $JWTManager->create($user)]); }
Symfony says that UserInterface
is not service so it can't Autowire it.Ok, then I've tried to find another articles about this problem. But surprisingly they just doesn't say how to write this method. For example, here https://digitalfortress.tech/php/jwt-authentication-with-symfony/ appears like route /api/login_check
must work authomatically if it configured in security.yaml
and in routes.yaml
. But no, it doesn't work.
So how must I write controller?
My security.yaml
is:
security: encoders: App\Entity\User: algorithm: bcrypt # https://symfony.com/doc/current/security.html#where-do-users-come-from-user-providers providers: app_user_provider: entity: class: App\Entity\User property: email firewalls: login: pattern: ^/api/login stateless: true anonymous: true json_login: check_path: /api/login_check success_handler: lexik_jwt_authentication.handler.authentication_success failure_handler: lexik_jwt_authentication.handler.authentication_failure api: pattern: ^/api stateless: true provider: app_user_provider guard: authenticators: - lexik_jwt_authentication.jwt_token_authenticator dev: pattern: ^/(_(profiler|wdt)|css|images|js)/ security: false main: anonymous: true # activate different ways to authenticate # https://symfony.com/doc/current/security.html#firewalls-authentication # https://symfony.com/doc/current/security/impersonating_user.html # switch_user: true # Easy way to control access for large sections of your site # Note: Only the *first* access control that matches will be used access_control: - { path: ^/register, roles: IS_AUTHENTICATED_ANONYMOUSLY } - { path: ^/api/login, roles: IS_AUTHENTICATED_ANONYMOUSLY } - { path: ^/api, roles: IS_AUTHENTICATED_FULLY }