如何在Symfony中注销被禁止的用户？

Question

Symfony provides a simple way of preventing users from logging in using the isEnabled property if the user class implements AdvancedUserInterface.

However, if the user is logged in nothing will prevent them from accessing the website until their session expires.

The idea would be to check the isEnabled property upon getting the user entity ($this->get('security.token_storage')->getToken()->getUser()) and to invalidate the session then. What is the preferred way of doing so?

Or is there a better way to achieve this goal?

Answer 1

You can set the following in your security.yml:

security:
    always_authenticate_before_granting: true

This will always re-authenticate a user before storing the information into the token. It will take care of these kind of changes in the user configuration, but also things like changed roles etc..