Custom Redirection with Programmatic Login

Contributed by Nicolas Sauveur
in #48582.

In Symfony 6.2 we introduced a login() method to ease the programmatic
login of users. However, this method returned void, so you couldn't customize
the response after the user login.
The underlying UserAuthenticator::authenticateUser() called by login()
returns a Response object which can be used to redirect the user. That's why
in Symfony 6.3, the login() method now returns that Response object too:

use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
use Symfony\Bundle\SecurityBundle\Security;
use Symfony\Component\HttpFoundation\Response;

class RegistrationController extends AbstractController
{
public function verifyUserEmail(Security $security): Response
{
// ...

$redirectResponse = $security->login($user);

return $redirectResponse;
}
}

Remember Me Option for JSON Logins

Contributed by Markus Baumer
in #48899.

JSON login is one of the built-in authentication mechanisms provided by Symfony.
It's popular e.g. when building APIs to generate security tokens based on a given
username (or email) and password.
Remember me is a built-in Symfony security feature that allows to store some
user credentials in a signed cookie so they don't have to provide them again the
next time they browse your application.
In Symfony 6.3 we're merging both features to provide Remember Me support for
JSON logins. To do so, add a _remember_me key (this name is configurable)
to the body of your POST request:

{
"username": "dunglas@example.com",
"password": "MyPassword",
"_remember_me": true
}

Clear Site Data After Logout

Contributed by Maximilian Beckers
in #49306.

The Clear-Site-Data HTTP header clears browsing data (cookies, storage, cache)
associated with the requesting website. It allows web developers to have more
control over the data stored by a client browser for their origins.
In Symfony 6.3, we're adding support for this HTTP header via the logout
configuration of your firewalls:

security:
# ...
firewalls:
main:
# ...
logout:
path: app_logout
# the available options are 'cache', 'cookies', 'storage', 'executionContexts'
# you can also use the '*' wildcard to clear all data
clear_site_data:
- cache
- storage
- executionContexts

Sponsor the Symfony project.