Fix Weak API Authentication in Symfony

Why weak API auth happens (fast, but fragile)

Quick launches often ship API keys in URLs, no throttling, and permissive CORS. Let’s replace that with JSON login + JWT, rate limiting, and strict CORS—then validate with the Website Vulnerability Scanner online free.

Fix Weak API Authentication in Symfony

What not to do

// ❌ Token in query string; no identity, no throttling
#[Route('/api/report', methods: ['GET'])]
public function report(Request $r): JsonResponse {
  if ($r->query->get('token') !== $_ENV['API_TOKEN']) {
    return new JsonResponse(['error'=>'unauthorized'], 401);
  }
  return new JsonResponse(['ok'=>true]);
}

Secure baseline: JSON login + JWT (stateless)

Install and generate keys:

composer require lexik/jwt-authentication-bundle
php bin/console lexik:jwt:generate-keypair

Minimal security config:

# config/packages/security.yaml
security:
  password_hashers:
    Symfony\Component\Security\Core\User\PasswordAuthenticatedUserInterface: 'auto'

  providers:
    app_user_provider:
      entity: { class: App\Entity\User, property: email }

  firewalls:
    main:
      pattern: ^/api
      stateless: true
      provider: app_user_provider
      json_login:
        check_path: /api/login
        username_path: email
        password_path: password
        success_handler: lexik_jwt_authentication.handler.authentication_success
        failure_handler: lexik_jwt_authentication.handler.authentication_failure
      login_throttling: { max_attempts: 5, interval: '1 minute' }

  access_control:
    - { path: ^/api/login, roles: PUBLIC_ACCESS }
    - { path: ^/api, roles: IS_AUTHENTICATED_FULLY }

JWT bundle settings:

# config/packages/lexik_jwt_authentication.yaml
lexik_jwt_authentication:
  secret_key: '%kernel.project_dir%/config/jwt/private.pem'
  public_key: '%kernel.project_dir%/config/jwt/public.pem'
  pass_phrase: '%env(JWT_PASSPHRASE)%'
  token_ttl: 3600

Add rate limits (beyond login)

# config/packages/rate_limiter.yaml
framework:
  rate_limiter:
    api_global:
      policy: 'token_bucket'
      limit: 60
      rate: { interval: '1 minute', amount: 60 }

Use it in controllers for sensitive endpoints.

Lock down CORS

# config/packages/nelmio_cors.yaml
nelmio_cors:
  defaults:
    allow_origin: ['https://app.example.com']
    allow_headers: ['Content-Type','Authorization']
    allow_methods: ['GET','POST','PUT','DELETE','OPTIONS']
    max_age: 3600
  paths:
    '^/api/': ~

Quick test flow

# 1) Get JWT
TOKEN=$(curl -sS -X POST https://yourdomain.com/api/login \
 -H "Content-Type: application/json" \
 -d '{"email":"jane@example.com","password":"secret"}' | jq -r .token)

# 2) Call protected route
curl -H "Authorization: Bearer $TOKEN" https://yourdomain.com/api/me

Insert screenshots (place these inside the body)

📸 Our Website Vulnerability Scanner Tool homepage

Screenshot of the free tools webpage where you can access security assessment tools.
Screenshot of the free tools webpage where you can access security assessment tools.

📸 Sample report from our tool to check Website Vulnerability

Sample vulnerability assessment report generated with our free tool, providing insights into possible vulnerabilities.
Sample vulnerability assessment report generated with our free tool, providing insights into possible vulnerabilities.

Hardening checklist

  • Use JSON login + JWT (short TTL).

  • Enable login throttling and custom rate limits.

  • Keep JWT keys outside web root; store passphrase in secrets.

  • Enforce Authorization: Bearer (no tokens in URLs).

  • Tight CORS with explicit origins/headers.

Run a fresh scan after changes: https://free.pentesttesting.com/

More how-tos on our blog: https://www.pentesttesting.com/blog/

Services from Pentest Testing Corp.

Managed IT Services

Keep auth secure in production with patching, monitoring, and incident response.
https://www.pentesttesting.com/managed-it-services/

AI Application Cybersecurity

Harden AI endpoints, tokens, and data flows.
https://www.pentesttesting.com/ai-application-cybersecurity/

Offer Cybersecurity to Your Clients

Agencies/MSPs: resell or bundle assessments and hardening.
https://www.pentesttesting.com/offer-cybersecurity-service-to-your-client/

Stay updated

Subscribe on LinkedIn https://www.linkedin.com/build-relation/newsletter-follow?entityUrn=7327563980778995713

Comments

Post a Comment

Popular posts from this blog

Fix Sensitive Data Exposure in Symfony Apps

Image
Symfony is a powerful PHP framework known for its flexibility and robustness. But like any web technology, if it's not properly secured, it can become a target for attackers — especially when it comes to Sensitive Data Exposure . In this post, we’ll explore how this vulnerability occurs in Symfony applications and provide secure coding examples to mitigate the risk. 💡 Need to check your site for security vulnerabilities? Use our Free Website Vulnerability Scanner online  today! 🔍 What is Sensitive Data Exposure? Sensitive Data Exposure occurs when an application unintentionally exposes data such as: Passwords Credit card information Session tokens Personal Identifiable Information (PII) In Symfony, this usually happens due to misconfigurations, improper error handling, or insecure data storage. ⚠️ Common Causes in Symfony Exposing stack traces in production Logging sensitive data (e.g., passwords or tokens) Storing plain-text credentials Weak e...
Read more

Fix Security Misconfiguration Issues in Symfony

Image
Security misconfiguration is one of the most common yet critical vulnerabilities in modern web applications. Symfony, being a powerful PHP framework, offers many configuration options—but when misused or left insecure, it becomes a prime target for attackers. In this blog post, we’ll explore how security misconfigurations can creep into Symfony applications, provide practical coding examples, and show you how to test your website using our Free Website Vulnerability Scanner online . 👉 Also check out more security tips on our blog at Pentest Testing Corp. 🔍 What is Security Misconfiguration? Security misconfiguration refers to improperly configured security controls or settings in software or hardware systems. In Symfony, this can include: Default configurations still active Debug mode enabled in production Insecure HTTP headers Overly verbose error messages Unprotected files and directories Unrestricted administrative panels Misconfigurations can give hacker...
Read more

Open Redirect Vulnerability in Symfony

Image
Open Redirect Vulnerability in Symfony: Risks, Exploits & Prevention Open Redirect vulnerabilities are often underestimated, yet they can be leveraged by attackers for phishing, social engineering, and redirect chains to malicious websites. If you're building or managing Symfony applications, understanding this vulnerability is crucial. In this blog, we'll explore how Open Redirect works in Symfony, provide real-world code examples, and demonstrate how to test your site using our free Website Security Scanner . 🔗 Also read more about other vulnerabilities on our official blog: Pentest Testing Blog 🔍 What Is an Open Redirect Vulnerability? An Open Redirect occurs when an application accepts a user-controlled input that specifies a link and redirects users to it without validating the destination. This allows attackers to send legitimate-looking links that redirect unsuspecting users to phishing or malicious websites. In Symfony, this might happen when improperly hand...
Read more