Silex: get information about authenticated users on routes outside the firewall

So: so far I have not found that this is possible thanks to the "normal" way, which is frustrating. I will not mark what I have detailed below as "answering" for a few days, hoping that someone can call back and suggest a better, more "official" way to resolve the dilemma.

TL; The DR: . I manually check the request headers for the access token string and then decode the token using JWT classes to load the user account on routes outside of the firewall. It is incredibly hacked, it feels completely messy, but this is the only solution to the problem I see at the moment.

Technical details . You must first get the token value from the request header. Your controller method will be passed an object Symfony\Component\HttpFoundation\Request

from which you can access $request->headers->get('X-Access-Token')

. In most cases, the user will not be authenticated, so it will be empty and you can return null.

If it is not empty, you should use a Silex instance JWTEncoder

to decode the contents of the token, create a new instance of the token JWTToken

, set the context to the decoded value from the encoder, and finally you can access the username from the specified token, which can then be used to capture the corresponding custom records. An example of what I ran into:

$request_token = $request->headers->get('X-Access-Token','');

if(empty($request_token)) {
  return null;
}

try {
  $decoded = $app['security.jwt.encoder']->decode($request_token);

  $token = new \Silex\Component\Security\Http\Token\JWTToken();
  $token->setTokenContext($decoded);

  $userName = $token->getTokenContext()->name;

  //Here, you'd use whatever "load by username" function you have at your disposal
}catch(\Exception $ex) {
  return null;
}

      

        
        
        
      

    

And, obviously, any code calling this function needs to know that since the request is outside the firewall, there is a zero guarantee that the user will be returned (hence a cracked try-catch that throws exceptions off by simply returning null

).

Edit . I have updated the code here to use the built-in DI Silex container (provided by Pimple) so there is no need to create a new JWT encoder instance manually. I also mark @ user5117342's answer as correct, as using some sort of Silex middleware approach is much more reliable.

Edit (Apr 2016) . Using the updated cnam / security-jwt-service 2.1.0 and Symfony / security 2.8 there is a small update that makes the above code a little simpler:

$request_token = $request->headers->get('X-Access-Token','');

if(empty($request_token)) {
  return null;
}

try {
  $decodedToken = $app['security.jwt.encoder']->decode($request_token);

  $userName = $decodedToken->name;

  //Here, you'd use whatever "load by username" function you have at your disposal
}catch(\Exception $ex) {
  return null;
}

      

        
        
        
      

    

The problem with newer dependencies is that the constructor JWTToken

requires 3 parameters, which is difficult to obtain in most service levels, not to mention that it is completely irrelevant. When I updated my Composer dependencies, I figured out that I really didn't need to create JWTToken

to get the username I wanted .

Of course, it should be noted that I only use this method for the public (anonymous) API routes to provide some subtleties to the users who are logged in - my application is not dealing with sensitive data, so I am not too concerned with this passage outside of firewalls. In the worst case, the black hat user will end up seeing non-sensitive data, which they usually wouldn't, but what it is. So YMMV.