Manage security/routing with Symfony2 by requesting a database

Question

Using Symfony2, I'm looking for a way to easily access the main route prefix for a given request, outside any controller:

I am trying to figure out the best way to deal with access control related to some database elements in Symfony2.

I would like to restrict the access to some 'applications' located in the path /application/APP_ID according to the Subscription stored in the database. Every restricted resource will be in this path.

The subscriptions are referencing a User entity and an Application entity. It includes an ending date. After this ending date, the application should not be accessible anymore.

The restriction should be : for every resource starting with /application/APP_ID, I need to check if the controller should be accessed. This prefix is static and is actually defined in the app/config/routing.yml as a 'prefix' and the corresponding route name is stored in one of the Application entity attributes. The other involved routes are defined in an independent routing.yml file located for example in MyAppBundle/Resources/config/routing.yml and imported in the main routing file.

Can I easily know if the current route requested (ex. /application/APP_ID/action/1) is included in the route defining the prefix (ex. /application/APP_ID) in order to know what Application is concerned?

Or, is there a way to do that without having to give a list of routes or paths which necessarily require modifications for every application added, route added or modified?

Answer 1

Did you try to develop your own Voter ? As explained here : http://symfony.com/doc/current/cookbook/security/voters.html.

Instead of testing $request->getClientIp, you could test $request->getRequestUri. And you could have an access to doctrine, using $this->container->get('doctrine'). I think you could have all informations you need to secure your paths.

I did it few days ago to store my own RoleHierachy in database, it works well.