Symfony “json_login” security parameter doesn't initialize controller

Question

I followed the "How to Build a JSON Authentication Endpoint" tutorial in Symfony's documentation but whenever I make the AJAX call at my login handler (the empty controller), I get a 500 error saying

"The controller must return a response (null given). Did you forget to add a return statement somewhere in your controller?"

Am I right to think that since I specified /loginhandler as the check_path in my security configuration, Symfony should not run the empty controller I provided but override it instead? When I tried to add a dummy JSON response to the controller, it returned just fine.

What am I doing wrong? I tried both /loginhandler and loginhandler as the check_path parameter.

This is my security.yml:

    firewalls:
    dev:
        pattern: ^/(_(profiler|wdt)|css|images|js)/
        security: false
    main:
        anonymous: ~
        json_login:
            check_path: /loginhandler

My empty controller is, well, an empty controller:

 /**
 * @Route("/loginhandler", name="loginhandler")
 */
 public function jsonLoginAction(Request $request)
 {
 }

And finally, this is my AJAX call:

fetch('{{ path('loginhandler') }}', {
    method: 'post',
    body: JSON.stringify({
        username: username,
        password: password
    }),
    credentials: 'same-origin'
}).then(function (response) {
    submitButton.html(submitButton.attr('data-text')).removeAttr('disabled');
    $("#loginForm").removeClass('attempted-submit');
    return response.json();
}).then(function (response) {
    console.log(response);
});

I am running Symfony 3.3.9 and PHP 7.1.6.

you should return a response in your controller, e.g. something like this.~ return new JsonResponse(['status' => 'ok']); — Petro Popelyshko
@PeterPopelyshko but the tutorial explicitly states that the controller should be empty. the Symfony security system should intercept the request to the controller and return the value on its own. I already tried returning a dummy response (as I wrote) and it worked, but the security process still wasn’t initialised. — user3453428
I have the same issue here with symfony 3.4.1. My check_path is /api/v1/token and I get the message Unable to find the controller for path "/api/v1/token". The route is wrongly configured. but only in test environment, in the dev environment it works... — Christian Fries

Julius Koronci Julius Koronci · Accepted Answer · 2017-11-21T19:51:21

their docs are broken and they are ignore the bug for more than a year now..you need to have a login and success handler..although don't remember how to set it up

Symfony “json_login” security parameter doesn't initialize controller

1 Answers