定制 Symfony 5.3 认证错误消息：深入理解与实践

// src/Security/LoginFormAuthenticator.php
namespace App\Security;

use Symfony\Component\HttpFoundation\Request;
use Symfony\Component\HttpFoundation\Response;
use Symfony\Component\HttpFoundation\RedirectResponse;
use Symfony\Component\Routing\Generator\UrlGeneratorInterface;
use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
use Symfony\Component\Security\Core\Exception\AuthenticationException;
use Symfony\Component\Security\Core\Exception\CustomUserMessageAuthenticationException;
use Symfony\Component\Security\Core\Security;
use Symfony\Component\Security\Http\Authenticator\AbstractLoginFormAuthenticator;
use Symfony\Component\Security\Http\Authenticator\Passport\Badge\CsrfTokenBadge;
use Symfony\Component\Security\Http\Authenticator\Passport\Badge\RememberMeBadge;
use Symfony\Component\Security\Http\Authenticator\Passport\Badge\UserBadge;
use Symfony\Component\Security\Http\Authenticator\Passport\Credentials\PasswordCredentials;
use Symfony\Component\Security\Http\Authenticator\Passport\Passport;
use Symfony\Component\Security\Http\Util\TargetPathTrait;

class LoginFormAuthenticator extends AbstractLoginFormAuthenticator
{
    use TargetPathTrait;

    private UrlGeneratorInterface $urlGenerator;

    public function __construct(UrlGeneratorInterface $urlGenerator)
    {
        $this->urlGenerator = $urlGenerator;
    }

    protected function getLoginUrl(Request $request): string
    {
        return $this->urlGenerator->generate('app_login');
    }

    public function authenticate(Request $request): Passport
    {
        $email = $request->request->get('email', '');
        $password = $request->request->get('password', '');
        $csrfToken = $request->request->get('_csrf_token');

        // 将用户名存储到会话，以便在登录失败后预填充表单
        $request->getSession()->set(Security::LAST_USERNAME, $email);

        // 示例：自定义错误，如果邮箱为空
        if (empty($email)) {
            throw new CustomUserMessageAuthenticationException('邮箱地址不能为空。');
        }

        // UserBadge 会尝试通过用户提供者加载用户。
        // 如果用户提供者抛出 UserNotFoundException 且 hide_user_not_found 为 false，
        // 则该消息会直接显示。
        // 如果 hide_user_not_found 为 true，则会转换为 BadCredentialsException。
        // 如果您想在此处强制自定义用户未找到消息，可以捕获 UserNotFoundException 并重新抛出。
        $userBadge = new UserBadge($email);

        return new Passport(
            $userBadge,
            new PasswordCredentials($password),
            [
                new CsrfTokenBadge('authenticate', $csrfToken),
                new RememberMeBadge(), // 根据您的需求添加
            ]
        );
    }

    public function onAuthenticationSuccess(Request $request, TokenInterface $token, string $firewallName): ?Response
    {
        if ($targetPath = $this->getTargetPath($request->getSession(), $firewallName)) {
            return new RedirectResponse($targetPath);
        }

        // 例如，重定向到主页
        return new RedirectResponse($this->urlGenerator->generate('homepage'));
    }

    public function onAuthenticationFailure(Request $request, AuthenticationException $exception): Response
    {
        if ($request->hasSession()) {
            // 这一行至关重要：它将 AuthenticationException 存储到会话中
            // 这样 AuthenticationUtils 才能获取到它。
            $request->getSession()->set(Security::AUTHENTICATION_ERROR, $exception);
        }

        $url = $this->getLoginUrl($request);

        return new RedirectResponse($url);
    }
}

// src/Security/UserRepository.php (如果您的 User 实体在 App\Entity\User)
namespace App\Security;

use App\Entity\User;
use Doctrine\Bundle\DoctrineBundle\Repository\ServiceEntityRepository;
use Doctrine\Persistence\ManagerRegistry;
use Symfony\Component\Security\Core\Exception\UserNotFoundException;
use Symfony\Component\Security\Core\User\PasswordAuthenticatedUserInterface;
use Symfony\Component\Security\Core\User\PasswordUpgraderInterface;
use Symfony\Component\Security\Core\User\UserInterface;
use Symfony\Component\Security\Core\User\UserProviderInterface;

/**
 * @extends ServiceEntityRepository<User>
 * @implements UserProviderInterface<User>
 */
class UserRepository extends ServiceEntityRepository implements UserProviderInterface, PasswordUpgraderInterface
{
    public function __construct(ManagerRegistry $registry)
    {
        parent::__construct($registry, User::class);
    }

    public function loadUserByIdentifier(string $identifier): UserInterface
    {
        // 假设 $identifier 是邮箱
        $user = $this->findOneBy(['email' => $identifier]);

        if (!$user) {
            // 抛出 UserNotFoundException。
            // 如果 security.yaml 中的 hide_user_not_found 为 false，
            // 此消息将显示在登录表单上。
            throw new UserNotFoundException(sprintf('邮箱 "%s" 未注册。', $identifier));
        }

        return $user;
    }

    // ... 其他必要方法，如 refreshUser, supportsClass, upgradePassword
}

// src/Security/UserChecker.php
namespace App\Security;

use App\Entity\User; // 您的用户实体
use Symfony\Component\Security\Core\User\UserInterface;