Download the PHP package 3brs/enterprise-security-bundle without Composer
On this page you can find all versions of the php package 3brs/enterprise-security-bundle. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.
Download 3brs/enterprise-security-bundle
More information about 3brs/enterprise-security-bundle
Files in 3brs/enterprise-security-bundle
Package enterprise-security-bundle
Short Description Standalone Symfony bundle with reusable security logic — interfaces, services, validators, event listeners
License MIT
FAQ
Example:
In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
- Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
- To use Composer is sometimes complicated. Especially for beginners.
- Composer needs much resources. Sometimes they are not available on a simple webspace.
- If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
- Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Informations about the package enterprise-security-bundle
Enterprise Security Bundle
A standalone Symfony bundle providing reusable security primitives — two-factor authentication, passkeys (WebAuthn/FIDO2), magic-link login, OAuth (Google, Apple, Microsoft), account lockout with rate limiting, session tracking, IP whitelist/blacklist, password policy / history / expiration, scope-wide password-login control, GDPR self-service account deletion, and a runtime-configurable settings store.
The bundle is framework-agnostic — drop it into any Symfony 6.4 / 7.4 app. It ships contracts and abstract flows, not a wired-up UI — you bind it to your app's entities, routes and templates. See the integration guide below for how to wire it into a Symfony project.
What the bundle provides
Authentication flows (abstract base controllers — you extend and bind to your app):
- Passkey login + registration (WebAuthn ceremony, browser-side
navigator.credentials.*) - Magic-link login request + verify
- OAuth login + callback + confirm-link (Google, Apple, Microsoft)
- Two-factor authentication setup wizard + recovery challenge
Self-service actions (abstract base controllers): session list / revoke / revoke-others · passkey list / delete · 2FA disable / regenerate recovery codes · OAuth account unlink · account deletion request (with grace period).
Admin actions (abstract base controllers): unlock user (after lockout) · cancel pending account deletion · locked users list.
Security engines & services (use directly via DI):
- 2FA:
TotpSecretGenerator,QrCodeGenerator,RecoveryCodeGenerator,TwoFactorEnforcementChecker(+TwoFactorModeenum),TwoFactorAwareAuthenticationSuccessHandler - Magic link:
MagicLinkTokenGenerator,MagicLinkTokenValidator - Passkey:
PasskeyValidatorFactory,PasskeyCeremonyStepManagerFactory,PasskeyRelyingPartyEntityFactory,PasskeyWebauthnSerializer,SessionPasskeyOptionsStorage - OAuth:
OAuthProviderRegistry+ Google / Apple / Microsoft providers,AutoRegistrationPolicy,OAuthLinkCodeGenerator+CodeChallengeValidator(confirm-link one-time-code: mint/hash, then verify with expiry + attempt limit + single-use) - Lockout & rate limiting:
LockoutPolicy,RateLimitGuard,DynamicRateLimiterFactory - Sessions:
UserAgentParser,SessionFingerprintGenerator,GeoIpLookup(MaxMind + Null impls) - Passwords:
PasswordExpirationChecker,PasswordSimilarityChecker(history),PasswordPolicyFilteringValidator+PasswordPolicy/PasswordHistorySymfony constraints - Network:
CidrMatcher,CidrListconstraint,AbstractIpRestrictionChecker/AbstractIpRestrictionListener(whitelist + blacklist enforcement) - Password-login control:
AbstractPasswordLoginCheckListener(disable password sign-in per scope; forces stronger methods) - Account deletion (GDPR):
GracePeriodCalculator,AbstractDueDeletionsProcessor(anonymization cron engine) - Settings store:
FeatureToggle,PolicyFactory,YamlConfigDefaultsProvider(runtime-configurable, scoped CUSTOMER / ADMIN / GLOBAL) - Hardening:
DeadlineTimingPadding— constant-time response padding against account enumeration - Twig extensions:
MagicLinkExtension,PasskeyExtension,SocialProvidersExtension
Contracts you implement (the bundle ships interfaces; you provide Doctrine-backed impls): persisted-record contracts (MagicLinkRecordInterface, SessionRecordInterface, SocialAccountLinkRecordInterface, CustomerDeletionRequestRecordInterface, PasskeyCredentialRecordInterface), repository contracts, the UserAnonymizerInterface, and per-feature user mixins (TwoFactorAuth*, Lockable*, PasswordExpiration*). The PasswordExpiration* mixins additionally require getCreatedAt(): ?\DateTimeInterface (the account creation timestamp) — used as the expiration fallback for users who have never changed their password, so wire it up on your user entity if it does not already expose one. See Interface implementations.
Features
The bundle covers 16 security features. Each row maps the feature to the bundle primitives that power it — follow the link for the feature-level narrative, config options and defaults.
| Feature | Bundle primitives | Doc |
|---|---|---|
| Password Policy | PasswordPolicy constraint + PasswordPolicyFilteringValidator |
password-policy |
| Password History | PasswordHistory constraint + PasswordSimilarityChecker |
password-history |
| Password Expiration | PasswordExpirationChecker + user mixins |
password-expiration |
| Password Change Notifications | password_change_notification.enabled settings toggle (notification is app-level) |
password-change-notifications |
| Two-Factor Authentication | TOTP / QR / recovery generators + enforcement checker + flow controllers | two-factor-authentication |
| 3rd-party OAuth (Social Login) | provider registry + Google/Apple/Microsoft + auto-registration policy + confirm-link code challenge (generator + validator) | oauth-social-login |
| Magic Link Login | token generator/validator + timing padding + flow controllers | magic-link-login |
| Passkey Login (WebAuthn/FIDO2) | WebAuthn serializer + validator factories + flow controllers | passkey-login |
| Account Lockout & Rate Limiting | LockoutPolicy + RateLimitGuard + DynamicRateLimiterFactory |
account-lockout-rate-limiting |
| Session Management & Login Notifications | session tracker + fingerprint + UA parser + GeoIP | session-management-login-notifications |
| Centralized Security Settings UI | settings provider/writer contracts + feature toggle + policy factory | centralized-security-settings-ui |
| Self-Service Account Deletion (GDPR) | grace-period calculator + due-deletions processor + anonymizer contract | account-deletion-gdpr |
| Admin IP Whitelist | CidrMatcher + CidrList constraint + IP restriction listener |
admin-ip-whitelist |
| Admin IP Blacklist | same IP restriction primitives (global deny list) | admin-ip-blacklist |
| Admin Customer Management | session / lockout / password primitives | admin-customer-management |
| Password Login Control | AbstractPasswordLoginCheckListener (scope-wide toggle) |
password-login |
Requirements
- PHP 8.3+
- Symfony 6.4 or 7.4
- A Doctrine ORM (the bundle itself has no ORM dep, but your app needs one to persist sessions, passkey credentials, magic-link tokens, etc.)
- A user entity implementing
Symfony\Component\Security\Core\User\UserInterface
Installation
Then register the bundle in config/bundles.php:
The bundle requires scheb/2fa-bundle for the 2FA flows; composer require pulls it in automatically.
Integration guide
The bundle is contract-first: you wire each feature you want. These pages walk through it (start at the top — each builds on the previous):
| Guide | Covers |
|---|---|
| Configuration | Rate-limiter cache pool, settings store, feature-flag defaults, required scalar parameters |
| Entities & persistence | User-entity mixins + the Doctrine records/repositories you provide |
| Interface implementations | The contracts you implement — with full reference impls (settings, magic-link, passkey) |
| Controllers | Extending the abstract flow controllers + the full shipped-controller reference + security checklist |
| Controllers your app must provide | UI pieces intentionally not abstracted (settings UI, force-password-change, recovery-codes page, GDPR cron, …) |
| Routes reference | Every controller, its verb and a sample path |
| Symfony security configuration | Firewall / scheb_2fa / OAuth provider wiring |
| Passkey front-end | The browser-side WebAuthn JavaScript |
| Templates & translations | Template variables, Twig extensions, translation domains |
Running tests
The bundle is self-contained — clone it, install its own deps, and run the tooling directly (no Docker required):
Using this bundle on Sylius
Building a Sylius store? You don't need to wire any of this by hand — the ThreeBRS Enterprise Security Plugin implements the ready-made Sylius UI on top of this bundle.
Changelog & upgrading
See UPGRADE.md for version-to-version migration steps.
License
MIT License. See LICENSE for details.
Credits
Developed by 3BRS
All versions of enterprise-security-bundle with dependencies
endroid/qr-code Version ^6.0
league/oauth2-client Version ^2.7
league/oauth2-google Version ^4.0
matomo/device-detector Version ^6.5
patrickbussmann/oauth2-apple Version ^0.4
psr/clock Version ^1.0
psr/event-dispatcher Version ^1.0
psr/log Version ^3.0
scheb/2fa-bundle Version ^7.13
scheb/2fa-totp Version ^7.13
scheb/2fa-trusted-device Version ^7.13
spomky-labs/otphp Version ^11.4
symfony/clock Version ^6.4|^7.4
symfony/config Version ^6.4|^7.4
symfony/polyfill-mbstring Version ^1.31
symfony/dependency-injection Version ^6.4|^7.4
symfony/form Version ^6.4|^7.4
symfony/framework-bundle Version ^6.4|^7.4
symfony/http-foundation Version ^6.4|^7.4
symfony/http-kernel Version ^6.4|^7.4
symfony/password-hasher Version ^6.4|^7.4
symfony/rate-limiter Version ^6.4|^7.4
symfony/routing Version ^6.4|^7.4
symfony/security-bundle Version ^6.4|^7.4
symfony/security-core Version ^6.4|^7.4
symfony/security-csrf Version ^6.4|^7.4
symfony/security-http Version ^6.4|^7.4
symfony/serializer Version ^6.4|^7.4
symfony/translation-contracts Version ^3.0
symfony/validator Version ^6.4|^7.4
thenetworg/oauth2-azure Version ^2.2
twig/twig Version ^3.0
web-auth/webauthn-lib Version ^5.0