2026年版 Symfony REST APIセキュリティ完全ガイド: OAuth2、レート制限、面接対策

# config/packages/security.yaml
security:
    firewalls:
        api:
            pattern: ^/api
            stateless: true
            access_token:
                token_handler:
                    introspection:
                        client_id: '%env(OAUTH_CLIENT_ID)%'
                        client_secret: '%env(OAUTH_CLIENT_SECRET)%'
                        introspection_url: '%env(OAUTH_INTROSPECTION_URL)%'

namespace App\Controller\Api;

use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
use Symfony\Component\HttpFoundation\JsonResponse;
use Symfony\Component\Routing\Attribute\Route;
use Symfony\Component\Security\Http\Attribute\IsGranted;

#[Route('/api/profile', methods: ['GET'])]
#[IsGranted('ROLE_USER')]
class ProfileController extends AbstractController
{
    public function __invoke(): JsonResponse
    {
        // トークンはイントロスペクションで既に検証済み
        $user = $this->getUser();
        
        return $this->json([
            'id' => $user->getId(),
            'email' => $user->getEmail(),
            'scopes' => $user->getRoles(),
        ]);
    }
}

# config/packages/framework.yaml
framework:
    rate_limiter:
        # 一般的なAPIレート制限: 1分間に100リクエスト
        api_limiter:
            policy: sliding_window
            limit: 100
            interval: '1 minute'
            
        # 認証エンドポイント用の厳格な制限
        login_limiter:
            policy: token_bucket
            limit: 5
            rate: { interval: '1 minute', amount: 5 }

namespace App\EventSubscriber;

use Symfony\Component\EventDispatcher\EventSubscriberInterface;
use Symfony\Component\HttpKernel\Event\RequestEvent;
use Symfony\Component\HttpKernel\Exception\TooManyRequestsHttpException;
use Symfony\Component\HttpKernel\KernelEvents;
use Symfony\Component\RateLimiter\RateLimiterFactory;

final class RateLimitSubscriber implements EventSubscriberInterface
{
    public function __construct(
        private readonly RateLimiterFactory $apiLimiter,
    ) {}

    public static function getSubscribedEvents(): array
    {
        return [KernelEvents::REQUEST => ['onRequest', 10]];
    }

    public function onRequest(RequestEvent $event): void
    {
        if (!$event->isMainRequest()) {
            return;
        }
        
        $request = $event->getRequest();
        
        // APIルートのみに適用
        if (!str_starts_with($request->getPathInfo(), '/api')) {
            return;
        }
        
        // クライアントIPまたは認証済みユーザーをリミッターキーとして使用
        $key = $request->getClientIp();
        $limiter = $this->apiLimiter->create($key);
        
        if (!$limiter->consume()->isAccepted()) {
            throw new TooManyRequestsHttpException();
        }
    }
}

# config/packages/security.yaml
security:
    firewalls:
        api:
            pattern: ^/api
            stateless: true
            access_token:
                token_handler:
                    oidc_user_info:
                        base_uri: '%env(OIDC_ISSUER)%'
                        claim: email

namespace App\Security;

use Lexik\Bundle\JWTAuthenticationBundle\Services\JWTTokenManagerInterface;
use Symfony\Component\Security\Http\AccessToken\AccessTokenHandlerInterface;
use Symfony\Component\Security\Http\Authenticator\Passport\Badge\UserBadge;

final class JwtTokenAuthenticator implements AccessTokenHandlerInterface
{
    public function __construct(
        private readonly JWTTokenManagerInterface $jwtManager,
    ) {}

    public function getUserBadgeFrom(string $accessToken): UserBadge
    {
        // 署名を自動的にデコードして検証
        $payload = $this->jwtManager->parse($accessToken);
        
        return new UserBadge($payload['sub']);
    }
}

namespace App\Security\Voter;

use App\Entity\Article;
use App\Entity\User;
use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
use Symfony\Component\Security\Core\Authorization\Voter\Voter;

final class ArticleVoter extends Voter
{
    public const EDIT = 'ARTICLE_EDIT';
    public const DELETE = 'ARTICLE_DELETE';

    protected function supports(string $attribute, mixed $subject): bool
    {
        return in_array($attribute, [self::EDIT, self::DELETE], true)
            && $subject instanceof Article;
    }

    protected function voteOnAttribute(
        string $attribute,
        mixed $subject,
        TokenInterface $token
    ): bool {
        $user = $token->getUser();
        
        if (!$user instanceof User) {
            return false;
        }
        
        /** @var Article $article */
        $article = $subject;
        
        // 管理者はすべての操作が可能
        if (in_array('ROLE_ADMIN', $user->getRoles(), true)) {
            return true;
        }
        
        // 著者は自分の記事を編集・削除可能
        return $article->getAuthor() === $user;
    }
}

#[Route('/api/articles/{id}', methods: ['PUT'])]
public function update(Article $article, Request $request): JsonResponse
{
    $this->denyAccessUnlessGranted(ArticleVoter::EDIT, $article);
    
    // 更新ロジック
}

namespace App\Dto;

use Symfony\Component\Validator\Constraints as Assert;

final class CreateArticleDto
{
    public function __construct(
        #[Assert\NotBlank]
        #[Assert\Length(max: 255)]
        public readonly string $title,
        
        #[Assert\NotBlank]
        public readonly string $content,
        
        // 意図的に省略: author, createdAt, status
        // これらはアプリケーションが設定し、クライアントが設定するものではない
    ) {}
}

# config/packages/nelmio_cors.yaml
nelmio_cors:
    defaults:
        allow_origin: ['%env(CORS_ALLOW_ORIGIN)%']
        allow_methods: ['GET', 'POST', 'PUT', 'DELETE', 'OPTIONS']
        allow_headers: ['Content-Type', 'Authorization']
        max_age: 3600
    paths:
        '^/api/':
            origin_regex: true
            allow_origin: ['^https://.*\.example\.com$']
            allow_credentials: true

security:
    firewalls:
        main:
            login_throttling:
                max_attempts: 5
                interval: '15 minutes'