# Security Advanced (Symfony)

> Custom authenticators, voters, security expressions, CSRF protection, XSS prevention, rate limiting, production hardening, JWT/OAuth2 misconfigurations

- 22 interview questions
- Senior
- [Interview Questions: Symfony](https://sharpskill.dev/en/technologies/symfony/interview-questions.md)

## 1. Which interface must a custom authenticator implement in Symfony 6+?

**Answer**

In Symfony 6+, custom authenticators must implement AuthenticatorInterface from the Security HTTP component. This interface defines the methods supports(), authenticate(), onAuthenticationSuccess(), onAuthenticationFailure() and optionally createToken(). It replaces the old Guard system that was used in Symfony 4/5.

## 2. What is the role of the supports() method in a custom authenticator?

**Answer**

The supports() method determines if the authenticator should handle the current request. It receives the Request and returns a boolean. If true, the authenticate() method followed by onAuthenticationSuccess() or onAuthenticationFailure() will be called. This allows having multiple active authenticators on the same firewall, each handling a specific authentication type.

## 3. What should the authenticate() method of a custom authenticator return on success?

**Answer**

The authenticate() method must return a Passport object containing a UserBadge (user identifier) and credentials badges. The Passport can also contain additional badges like CsrfTokenBadge or RememberMeBadge. Symfony then uses this Passport to create the authentication token and load the user via the UserProvider.

## 19 more questions available

- How to define a custom Voter to control access to a specific resource?
- Which AccessDecisionManager strategy is recommended for applications requiring strict security?

Sign up for free: https://sharpskill.dev/en/login

## Other Symfony interview topics

- [Modern PHP (8.1+)](https://sharpskill.dev/en/technologies/symfony/interview-questions/php-modern-features.md): 20 questions, Junior
- [Symfony Basics](https://sharpskill.dev/en/technologies/symfony/interview-questions/symfony-basics.md): 25 questions, Junior
- [Routing & Controllers](https://sharpskill.dev/en/technologies/symfony/interview-questions/routing-controllers.md): 20 questions, Junior
- [Twig & Templates](https://sharpskill.dev/en/technologies/symfony/interview-questions/twig-templates.md): 20 questions, Junior
- [Doctrine ORM Basics](https://sharpskill.dev/en/technologies/symfony/interview-questions/doctrine-orm-basics.md): 25 questions, Junior
- [Symfony Forms](https://sharpskill.dev/en/technologies/symfony/interview-questions/forms.md): 22 questions, Junior
- [Data Validation](https://sharpskill.dev/en/technologies/symfony/interview-questions/validation.md): 18 questions, Junior
- [Dependency Injection & Services](https://sharpskill.dev/en/technologies/symfony/interview-questions/dependency-injection.md): 24 questions, Mid-Level
- [Security & Authentication](https://sharpskill.dev/en/technologies/symfony/interview-questions/security-authentication.md): 26 questions, Mid-Level
- [Doctrine Advanced](https://sharpskill.dev/en/technologies/symfony/interview-questions/doctrine-advanced.md): 24 questions, Mid-Level
- [API Platform](https://sharpskill.dev/en/technologies/symfony/interview-questions/api-platform.md): 22 questions, Mid-Level
- [Serializer Component](https://sharpskill.dev/en/technologies/symfony/interview-questions/serializer.md): 20 questions, Mid-Level
- [Events & Event Subscribers](https://sharpskill.dev/en/technologies/symfony/interview-questions/events-subscribers.md): 20 questions, Mid-Level
- [Console & Commands](https://sharpskill.dev/en/technologies/symfony/interview-questions/console-commands.md): 18 questions, Mid-Level
- [Messenger Component](https://sharpskill.dev/en/technologies/symfony/interview-questions/messenger.md): 22 questions, Mid-Level
- [HTTP Client](https://sharpskill.dev/en/technologies/symfony/interview-questions/http-client.md): 18 questions, Mid-Level
- [Cache & Performance](https://sharpskill.dev/en/technologies/symfony/interview-questions/cache.md): 20 questions, Mid-Level
- [Workflow Component](https://sharpskill.dev/en/technologies/symfony/interview-questions/workflow.md): 18 questions, Mid-Level
- [Testing Symfony](https://sharpskill.dev/en/technologies/symfony/interview-questions/testing.md): 22 questions, Mid-Level
- [Mailer Component](https://sharpskill.dev/en/technologies/symfony/interview-questions/mailer.md): 16 questions, Mid-Level
- [Translations & i18n](https://sharpskill.dev/en/technologies/symfony/interview-questions/translations.md): 16 questions, Mid-Level
- [EasyAdmin Bundle](https://sharpskill.dev/en/technologies/symfony/interview-questions/easyadmin.md): 18 questions, Mid-Level
- [Symfony Architecture](https://sharpskill.dev/en/technologies/symfony/interview-questions/architecture-patterns.md): 24 questions, Senior
- [Performance & Optimization](https://sharpskill.dev/en/technologies/symfony/interview-questions/performance-optimization.md): 22 questions, Senior
- [Custom Bundles](https://sharpskill.dev/en/technologies/symfony/interview-questions/custom-bundles.md): 20 questions, Senior
- [Microservices with Symfony](https://sharpskill.dev/en/technologies/symfony/interview-questions/microservices.md): 22 questions, Senior
- [Real-time & WebSockets](https://sharpskill.dev/en/technologies/symfony/interview-questions/real-time.md): 18 questions, Senior
- [Deployment & DevOps](https://sharpskill.dev/en/technologies/symfony/interview-questions/deployment-devops.md): 20 questions, Senior

---

Source: SharpSkill (https://sharpskill.dev), tech interview preparation for your real stack.
HTML version of this page: https://sharpskill.dev/en/technologies/symfony/interview-questions/security-advanced