Symfony News

New in Symfony 4.1: Deprecated the AdvancedUserInterface

Contributed by
Iltar van der Berg
in #23508.

Security is the trickiest part of any application, but the Symfony Security component helps you solving most of those problems. However, providing simple security tools to developers while maintaining first-class security which follows the latest best practices in the security field is a challenging problem.

One of our ongoing goals for security is to simplify some of its features. That's why in Symfony 4.1 we have deprecated the AdvancedUserInterface. This interface provided extra methods to the base user class related to account status flags:

1
2
3
4
5
6
7
8
9

namespace Symfony\Component\Security\Core\User;

interface AdvancedUserInterface extends UserInterface
{
    public function isAccountNonExpired();
    public function isAccountNonLocked();
    public function isCredentialsNonExpired();
    public function isEnabled();
}

Given that these methods are mostly related to your application domain logic, we've decided to deprecate it in Symfony 4.1 and remove it in Symfony 5.0. No alternative is provided for this interface. If you need this kind of checks, create a user checker, which perform additional checks during the authentication of a user to verify if the identified user is allowed to log in.