search

SymfonyCasts / verify-email-bundle

Simple, stylish Email Verification for Symfony
https://symfonycasts.com
MIT License
408 stars 33 forks source link

Block login when isVerified is False #190

Open keoozDan opened 3 months ago

keoozDan commented 3 months ago

I think that user with isVerified is false can login.

How can we block the login because : 1/ In app_verify_email we use : $this->denyAccessUnlessGranted('IS_AUTHENTICATED_FULLY'); 2/ In UserChecker.php : we can't block for false isVerified because we block the verification too

Have you any solution ?

jrushlow commented 3 months ago

Howdy @keoozDan - In very broad, general terms, it's usually best to allow a user to authenticate (Authentication) regardless if they're "verified" or not. To prevent access (Authorization) to all or part of an application for "non-verified" users, Symfony's Security Voter system can help with that depending on your needs. https://symfony.com/doc/current/security/voters.html

If you really want to only allow users who have verified their email address to be able to login (authentication), then you would probably need to use a custom authenticator or some sort of custom security events to handle that gracefully.

Hope this helps!