Redirección personalizada cuando "Email no verificado"

Hi! Thanks for this great tutorial!
But at the last step - add resending response to CheckVerifiedUserSubscriber - went something wrong.
The same code (but Symfony 6) - but instead of being redirected to "app_verify_resend_email" in the browser - appears this error:
Typed property App\EventSubscriber\CheckVerifiedUserSubscriber::$router must not be accessed before initialization
Any hint how to fix it?

Solved! Sorry, my mistake. Wrong typing in construct ...

it happens ;)

Cheers and happy coding!

If one wanted to expand the forced verification beyond the login event to ensure no access to any resources would be accessed by an account that isn't verified would the better way be to create a listener for kernel.request? I have code working doing this but would prefer to know ahead of time if I'm going to cause problems down the road. Here's what I did so far.

services.yaml

App\Listeners\UserListener:
    tags:
        - { name: kernel.event_listener, event: kernel.request, method: onKernelRequest}

UserListener.php

public function onKernelRequest(RequestEvent $event)
{
    // Ignore sub requests
    if ($event->getRequestType() != HttpKernel::MAIN_REQUEST)
    {
        // Don't process further
        return;
    }


    $user = $this->security->getUser();
    if (!($user instanceof User))
    {
        // User object not yet created
        return;
    }



    // Check whether logged-in user hasn't verified their account yet
    if (!$user->isVerified())
    {
        // Prevent circular redirects

        if ($event->getRequest()->attributes->get('_controller') != 'App\Controller\RegistrationController::resendVerifyEmail')
        {
            $event->setResponse(new RedirectResponse($this->router->generate('app_verify_resend_email')));
            return;
        }
    }
}

Note this is some legacy code from a proof of concept I built a while back. I tested moving it into the CheckVerifiedUserSubscriber subscribed events and that seems to work fine. Not sure it makes sense to wrap this into that class given that event is more broad in potential use but I'm guessing it would be best to keep the work happening on each request to a minimum.

Hi ! Thanks for the tutorial ! It was precious for me !

So I did all like you but now, I've always a LoginFailureEvent even thought I click on the link into the confirmation mail to verify email address 😭 I'm in a magic loop 😅

Hey Chris

Could you tell me more info about the error. What error message did you get? Does it happen on every request? If so, there must be something wrong in your authenticator's supports() method

Cheers!

Hi MolloKhan !

Thanks for replying me !
I will try to explain with my bad english my problem 😅

So, I installed the bundle verify-email-bundle : https://github.com/SymfonyCasts/verify-email-bundle on my project. It's work fine ! Cool !

But a user not verified can log in. There is not a deny access for the not verified user.

Therefore, I found your tuto and I'm trying to develop it in my project.

It's OK, all users not verified are redirect to the resending email confirmation page "/verify/resend_email".
But, when users come from the link of the email confirmation, they are rejected too after logging in.
"An authentication exception occurred."
This link needs user to log in before being verified.

/eventSubscriber/CheckVerifiedUserSubscriber.php :

`
class CheckVerifiedUserSubscriber implements EventSubscriberInterface
{

private RouterInterface $router;
private RequestStack $requestStack;

public function __construct(RouterInterface $router, RequestStack $requestStack)
{
    $this->router = $router;
    $this->requestStack = $requestStack;
}

public function onCheckPassport(CheckPassportEvent $event)
{
    $passport = $event->getPassport();

    $user = $passport->getUser();
    if (!$user instanceof User) {
        throw new \Exception('Unexpected user type');
    }

    //Si l'utilisateur n'est pas vérifié, l'authentification échoue
    if (!$user->isVerified()) {
        throw new AccountNotVerifiedAuthenticationException;
    }
}

public function onLoginFailure(LoginFailureEvent $event)
{
    if (!$event->getException() instanceof AccountNotVerifiedAuthenticationException) {
        return;
    }

    $request = $this->requestStack->getCurrentRequest();
    $targetPath = $request->getSession()->get('_security.main.target_path');
    // dd($targetPath);
    if (strpos($targetPath, '/verify/email?') !== false) {
        return new RedirectResponse($targetPath);
    } else {
        $passport = $event->getPassport();

        $user = $passport->getUser();
        if (!$user instanceof User) {
            throw new \Exception('Unexpected user type');
        }

        $email = $user->getEmail();
        $request->getSession()->set('non_verified_email', $email);

        $response = new RedirectResponse(
            $this->router->generate('app_verify_resend_email')
        );
        $event->setResponse($response);
    }
}

public static function getSubscribedEvents()
{
    return [
        CheckPassportEvent::class => ['onCheckPassport', -10],
        LoginFailureEvent::class => 'onLoginFailure',
    ];
}

}`

src/Controller/RegistrationController.php :

`
#[Route('/verify/resend_email', name: 'app_verify_resend_email')]

public function resendVerifyEmail(Request $request, UserRepository $userRepository)
{
    if ($request->isMethod('POST')) {
        $email = $request->getSession()->get('non_verified_email');
        $user = $userRepository->findOneBy(['email' => $email]);
        if (!$user) {
            throw $this->createNotFoundException('user not found for email');
        }
        // generate a signed url and email it to the user
        $this->emailVerifier->sendEmailConfirmation(
            'app_verify_email',
            $user,
            (new TemplatedEmail())
                ->from(new Address($_ENV['MAILER_USER'], 'Avisa Partners'))
                ->to($user->getEmail())
                ->subject('Please Confirm your Email')
                ->htmlTemplate('registration/confirmation_email.html.twig')
        );

        $this->addFlash('success', 'An email has been sended to you. Please click on the link into.');

        return $this->redirectToRoute('app_home');
    }

    return $this->render('registration/resend_verify_email.html.twig');
}

`

Do you have an idea for bypass the onLoginFailure when the user click on the link of the confirmation email ?
Because I don't want bypass the log in form before verification for security.

I hope to be understandable 🙏🏻😬

Thanks !

Maybe the only way is to verify their email address without having to be authenticated ?
What do you think ? 😑

Hey Chris

I noticed the bundle support both ways, validating anon and logged in users. You need to decide first what method you want to leverage and then add the code shown in their docs https://github.com/SymfonyC...

I hope it helps. Cheers!

Hey MolloKhan !

Yes I fixed my issue with the anonymous validation. It's Ok now :)

Thanks for your help !

Cheers !

Hi, thanks for the tutorial, but please
"I did include a button to resend the email, but I'll leave the implementation to you." don't say that haha... i don't know what i have to do. I can't understand neither how who commented before me did it. Could you please post the code to re-send the link?, i mean.. It's something what we expected to learn watching this tutorials. Thanks you and have a have a good weekend :)

Hey Leonel D. !

Fair enough :). Here is what I would do:

A) From inside of CheckVerifiedUserSubscriber - https://symfonycasts.com/screencast/symfony-security/login-failure#codeblock-d5a84a00cc - inside of onLoginFailure(), I would set the email of the user into the session. Something like:

public function onLoginFailure(LoginFailureEvent $event)
{
    if (!$event->getException() instanceof AccountNotVerifiedAuthenticationException) {
        return;
    }

    // ADD these 3 lines!
    $request = $event->getRequest();
    $email = $event->getPassport()->getUser()->getEmail();
    $request->getSession()->set('non_verified_email', $email);
    
    $response = new RedirectResponse(
        $this->router->generate('app_verify_resend_email')
    );
    $event->setResponse($response);
}

Then, in resend_verify_email.html.twig, for the "Re-Send Email" link, I would actually make that form with a button so that it POSTs back to the controller when pressed:

<form method="POST">
    <button type="submit" class="btn btn-primary">Re-send Email</button>
</form>

Finally, in the resendVerifyEmail() controller method, IF the method is POST, let's re-send the email:

/**
 * @Route("/verify/resend", name="app_verify_resend_email")
 */
public function resendVerifyEmail(Request $request, VerifyEmailHelperInterface $verifyEmailHelper, UserRepository $userRepository)
{
    if ($request->isMethod('POST')) {
         // resend the email here
         // probably, you will want to centralize all of this logic
         // into a service so you can call it from here and also
         // from RegistrationController after a successful registration

        $email = $request->getSession()->get('non_verified_email');
        $user = $userRepository->findOneBy(['email' => $email]);
        if (!$user) {
            throw $this->createNotFoundException('user not found for email');
        }

         $signatureComponents = $verifyEmailHelper->generateSignature(
             'app_verify_email',
             $user->getId(),
             $user->getEmail(),
             ['id' => $user->getId()]
         );

        // TODO: in a real app, send this as an email!
        $this->addFlash('success', 'Confirm your email at: '.$signatureComponents->getSignedUrl());

        return $this->redirectToRoute('app_homepage');
    }

    return $this->render('registration/resend_verify_email.html.twig');
}

Let me know if this helps :).

Cheers!

Thanks for sharing your approach.

I have got one thing to add:

In CheckVerifiedUserSubscriber class you have to add RequestStack $requestRequeststack to the Constructor so that you can use the current Request in the method of the subscriber via $request = $this->requestStack->getCurrentRequest();

Then I also got a question. How can I get the User in the resendVerifyEmail(9 controller method?

Since we are not verified at this point, we can NOT use the controllers $this->getUser() helper an can not access the private non_verified_email property of the session, or am I wrong?

Thanks!

Hey Tristan P.!

In CheckVerifiedUserSubscriber class you have to add RequestStack $requestRequeststack to the Constructor so that you can use the current Request in the method of the subscriber via $request = $this->requestStack->getCurrentRequest();

Ah, you're right! Thank you - I updated my code above. Actually, you can get the Request even easier with $event->getRequest() on this case.

And, I can see that you answered your other question, but I can see that it wasn't clear in my code. I'll update that as well!

Cheers!

Ok, I am sorry. I can of course get the user in the controller method, I just have get the email from the session via

`

$session->get('non_verified_email');

`

Then I can use the repo to get the user.

I just hat a typo when trying to get the property from the session

"I did include a button to resend the email, but I'll leave the implementation to you."

I used the AuthenticationUtils to get the last username to find out who is trying to resend email. And then made a request via UserRepository (findOneBy) and generated new link.

Did I do it right? :)

Hey there!

Sounds good! But because the last username is in session and it's not robust solution probably. If the users is authenticated - you can try to get it from the controller. If you extends the Symfony abstract controller - you can get the current user with getUser() call. Otherwise, you can inject the Security service that will bring you the same getUser() method to fetch. the currently authenticated user object.

Cheers!

Hi ,
how can I pass the user to the resend route in register controller so i can after that resend the email to him if he click the resend bouton.
i don't pass it into the url since bad personnes can change it and resend verification email to another users .
any solution to do it securely please ?

Hey Khaled L.!

That's a really good question! A simple solution would be to, from the subscriber we create, store the user's id into the session. Then in the resend action, read it from the session (404 if nothing is there), query for the User and re-send the email.

Cheers!

Hi...Works pretty fine. Thanks !