src/Domain/User/Symfony/EventSubscriber/Security/AuthenticationSubscriber.php line 46

Open in your IDE?
  1. <?php
  3. namespace App\Domain\User\Symfony\EventSubscriber\Security;
  5. use App\Domain\User\Exception\ExceededLoginAttemptsException;
  6. use App\Domain\User\Model\LoginAttempt;
  7. use App\Domain\User\Repository\LoginAttempt as LoginAttemptRepository;
  8. use App\Domain\User\Repository\User as UserRepository;
  9. use Symfony\Component\EventDispatcher\EventDispatcherInterface;
  10. use Symfony\Component\EventDispatcher\EventSubscriberInterface;
  11. use Symfony\Component\HttpFoundation\RequestStack;
  12. use Symfony\Component\Security\Core\AuthenticationEvents;
  13. use Symfony\Component\Security\Core\Event\AuthenticationFailureEvent;
  14. use Symfony\Component\Security\Core\Event\AuthenticationSuccessEvent;
  16. class AuthenticationSubscriber implements EventSubscriberInterface
  17. {
  18.     protected RequestStack $requestStack;
  19.     protected LoginAttemptRepository $loginAttemptRepository;
  20.     protected UserRepository $userRepository;
  21.     protected int $maxAttempts;
  22.     protected EventDispatcherInterface $dispatcher;
  24.     public function __construct(
  25.         RequestStack $requestStack,
  26.         LoginAttemptRepository $loginAttemptRepository,
  27.         UserRepository $userRepository,
  28.         int $maxAttempts,
  29.         EventDispatcherInterface $dispatcher
  30.     ) {
  31.         $this->requestStack           = $requestStack;
  32.         $this->loginAttemptRepository = $loginAttemptRepository;
  33.         $this->userRepository         = $userRepository;
  34.         $this->maxAttempts            = $maxAttempts;
  35.         $this->dispatcher             = $dispatcher;
  36.     }
  38.     public static function getSubscribedEvents(): array
  39.     {
  40.         return [
  41.             AuthenticationEvents::AUTHENTICATION_FAILURE => 'onAuthFailure',
  42.             AuthenticationEvents::AUTHENTICATION_SUCCESS => 'onAuthSuccess',
  43.         ];
  44.     }
  46.     public function onAuthFailure(AuthenticationFailureEvent $event)
  47.     {
  48.         $ip      = $this->requestStack->getCurrentRequest()->getClientIp();
  49.         $email   = $event->getAuthenticationToken()->getUsername();
  50.         $attempt = $this->loginAttemptRepository->findOneOrNullByIpAndEmail($ip, $email);
  52.         // If this is the first login attempt, create new entity
  53.         if (null === $attempt) {
  54.             $attempt = new LoginAttempt();
  55.             $attempt->setAttempts(0);
  56.             $attempt->setIp($ip);
  57.             $attempt->setEmail($email);
  58.             $this->loginAttemptRepository->insert($attempt);
  59.         }
  61.         $n = $attempt->getAttempts();
  63.         $attempt->setAttempts($attempt->getAttempts() + 1);
  65.         if ($attempt->getAttempts() > $this->maxAttempts) {
  66.             $user = $this->userRepository->findOneOrNullByEmail($email);
  67.             // Disable this user if it exists and the maximum number of login attempts was exceeded
  68.             if ($user) {
  69.                 $user->setEnabled(false);
  70.                 $attempt->setAttempts(0);
  71.                 $this->loginAttemptRepository->update($attempt);
  72.                 $this->userRepository->update($user);
  74.                 throw new ExceededLoginAttemptsException();
  75.             }
  76.         }
  78.         $this->loginAttemptRepository->update($attempt);
  79.         // Exponential wait time for wrong passwords
  80.         sleep($n);
  81.     }
  83.     public function onAuthSuccess(AuthenticationSuccessEvent $event)
  84.     {
  85.         if (!$event->getAuthenticationToken()) {
  86.             return;
  87.         }
  89.         $user = $event->getAuthenticationToken()->getUser();
  90.         if (is_string($user)) {
  91.             return;
  92.         }
  94.         $ip      = $this->requestStack->getCurrentRequest()->getClientIp();
  95.         $email   = $event->getAuthenticationToken()->getUsername();
  96.         $attempt = $this->loginAttemptRepository->findOneOrNullByIpAndEmail($ip, $email);
  97.         // If the attempt exists, we reset the number of attempts to zero on successful login.
  98.         if ($attempt) {
  99.             $attempt->setAttempts(0);
  100.             $this->loginAttemptRepository->update($attempt);
  101.         }
  102.     }
  103. }