make-security-custom
Skill4 starsChanged 2 months agoMITView on GitHub
Use when authentication needs a custom authenticator because no built-in mechanism — form login, JSON login, access tokens, HTTP basic — fits.
In this repository24 other files it gives its agents.
- AGENTS.mdAGENTS.md
- cli-conventionsSkill
- componentsSkill
- configurationSkill
- discoverSkill
- make-ciSkill
- make-commandSkill
- make-controllerSkill
- make-crudSkill
- make-decoratorSkill
- make-entitySkill
- make-formSkill
- make-listenerSkill
- make-migrationSkill
- make-registration-formSkill
- make-reset-passwordSkill
- make-security-form-loginSkill
- make-testSkill
- make-twig-extensionSkill
- make-userSkill
- make-voterSkill
- make-webhookSkill
- servicesSkill
- templatesSkill
The file
Files
Custom authenticator
symfony console make:security:custom ApiTokenAuthenticatorThe class name is the argument; the class lands in App\Security with an
Authenticator suffix. The maker installs symfony/security-bundle itself when
security.yaml is missing, because the recipe is what writes that file.
Before running it
A custom authenticator is the last resort. form_login, json_login, access_token
and http_basic cover the common mechanisms, and authorization is voters and
#[IsGranted], not an authenticator. Reach here only when the mechanism itself is
nonstandard.
What you get
A skeleton with the decisions stubbed out: supports() says whether this authenticator
handles the request, authenticate() builds the Passport (a UserBadge, and a
SelfValidatingPassport for token-style credentials), and the success and failure
handlers return the responses. That logic is yours; the maker cannot know it.
Check the security.yaml diff
The maker registers the class under the main firewall's custom_authenticators, and
it sets that list rather than appending to it. An authenticator already registered there
is replaced, and main may not be the firewall you meant. Read the security.yaml diff
before committing.
Does it work?
Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.
No reviews yet
People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.
- It worked
- Partly
- It didn't
Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.
Your trail
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
Now do this for your own.
Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.