PHPackages 3brs/enterprise-security-bundle - PHPackages - PHPackages [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register) 1. [Directory](/) 2. / 3. [Security](/categories/security) 4. / 5. 3brs/enterprise-security-bundle ActiveSymfony-bundle[Security](/categories/security) 3brs/enterprise-security-bundle =============================== Standalone Symfony bundle with reusable security logic — interfaces, services, validators, event listeners v2.1.0(2w ago)0219↑100%MITPHPPHP ^8.3CI passing Since Jun 15Pushed 2w agoCompare [ Source](https://github.com/3BRS/enterprise-security-bundle)[ Packagist](https://packagist.org/packages/3brs/enterprise-security-bundle)[ RSS](/packages/3brs-enterprise-security-bundle/feed)WikiDiscussions main Synced 2w ago READMEChangelog (4)Dependencies (76)Versions (6)Used By (0) [ ![](https://camo.githubusercontent.com/bb0c16caf210bea68e0e59fc11e0844dc47097f9aeb8b388c3de5f1414d4d1c0/68747470733a2f2f33627273312e667261312e63646e2e6469676974616c6f6365616e7370616365732e636f6d2f336272732f6c6f676f2f334252532d6c6f676f2d73796c6975732d3230302e706e67) ](https://www.3brs.com) Enterprise Security Bundle [ ![](https://camo.githubusercontent.com/08775adf88f54b60f89afe1acbe59a79fd748bc9340e0830a72b76b54e63f276/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f6c2f336272732f656e74657270726973652d73656375726974792d62756e646c652e737667) ](https://packagist.org/packages/3brs/enterprise-security-bundle "License") [ ![](https://camo.githubusercontent.com/49b9c5a0eb42807763baad3015a71239cef2862189fbcd927e3ac5e3353cbba8/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f762f336272732f656e74657270726973652d73656375726974792d62756e646c652e737667) ](https://packagist.org/packages/3brs/enterprise-security-bundle "Version") [ ![](https://github.com/3BRS/enterprise-security-bundle/actions/workflows/ci.yml/badge.svg) ](https://github.com/3BRS/enterprise-security-bundle/actions "Build status") =============================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================== [](#----enterprise-security-bundle----------------------------------------------------) A standalone Symfony bundle providing reusable security primitives — two-factor authentication, passkeys (WebAuthn/FIDO2), magic-link login, OAuth (Google, Apple, Microsoft), account lockout with rate limiting, session tracking, IP whitelist/blacklist, password policy / history / expiration, scope-wide password-login control, GDPR self-service account deletion, and a runtime-configurable settings store. The bundle is framework-agnostic — drop it into any Symfony 6.4 / 7.4 app. It ships **contracts and abstract flows, not a wired-up UI** — you bind it to your app's entities, routes and templates. See the [integration guide](#integration-guide) below for how to wire it into a Symfony project. --- What the bundle provides ------------------------ [](#what-the-bundle-provides) **Authentication flows** (abstract base controllers — you extend and bind to your app): - Passkey login + registration (WebAuthn ceremony, browser-side `navigator.credentials.*`) - Magic-link login request + verify - OAuth login + callback + confirm-link (Google, Apple, Microsoft) - Two-factor authentication setup wizard + recovery challenge **Self-service actions** (abstract base controllers): session list / revoke / revoke-others · passkey list / delete · 2FA disable / regenerate recovery codes · OAuth account unlink · account deletion request (with grace period). **Admin actions** (abstract base controllers): unlock user (after lockout) · cancel pending account deletion · locked users list. **Security engines & services** (use directly via DI): - **2FA:** `TotpSecretGenerator`, `QrCodeGenerator`, `RecoveryCodeGenerator`, `TwoFactorEnforcementChecker` (+ `TwoFactorMode` enum), `TwoFactorAwareAuthenticationSuccessHandler` - **Magic link:** `MagicLinkTokenGenerator`, `MagicLinkTokenValidator` - **Passkey:** `PasskeyValidatorFactory`, `PasskeyCeremonyStepManagerFactory`, `PasskeyRelyingPartyEntityFactory`, `PasskeyWebauthnSerializer`, `SessionPasskeyOptionsStorage` - **OAuth:** `OAuthProviderRegistry` + Google / Apple / Microsoft providers, `AutoRegistrationPolicy`, `OAuthLinkCodeGenerator` + `CodeChallengeValidator` (confirm-link one-time-code: mint/hash, then verify with expiry + attempt limit + single-use) - **Lockout & rate limiting:** `LockoutPolicy`, `RateLimitGuard`, `DynamicRateLimiterFactory` - **Sessions:** `UserAgentParser`, `SessionFingerprintGenerator`, `GeoIpLookup` (MaxMind + Null impls) - **Passwords:** `PasswordExpirationChecker`, `PasswordSimilarityChecker` (history), `PasswordPolicyFilteringValidator` + `PasswordPolicy` / `PasswordHistory` Symfony constraints - **Network:** `CidrMatcher`, `CidrList` constraint, `AbstractIpRestrictionChecker` / `AbstractIpRestrictionListener` (whitelist + blacklist enforcement) - **Password-login control:** `AbstractPasswordLoginCheckListener` (disable password sign-in per scope; forces stronger methods) - **Account deletion (GDPR):** `GracePeriodCalculator`, `AbstractDueDeletionsProcessor` (anonymization cron engine) - **Settings store:** `FeatureToggle`, `PolicyFactory`, `YamlConfigDefaultsProvider` (runtime-configurable, scoped CUSTOMER / ADMIN / GLOBAL) - **Hardening:** `DeadlineTimingPadding` — constant-time response padding against account enumeration - **Twig extensions:** `MagicLinkExtension`, `PasskeyExtension`, `SocialProvidersExtension` **Contracts you implement** (the bundle ships interfaces; you provide Doctrine-backed impls): persisted-record contracts (`MagicLinkRecordInterface`, `SessionRecordInterface`, `SocialAccountLinkRecordInterface`, `CustomerDeletionRequestRecordInterface`, `PasskeyCredentialRecordInterface`), repository contracts, the `UserAnonymizerInterface`, and per-feature user mixins (`TwoFactorAuth*`, `Lockable*`, `PasswordExpiration*`). The `PasswordExpiration*` mixins additionally require `getCreatedAt(): ?\DateTimeInterface` (the account creation timestamp) — used as the expiration fallback for users who have never changed their password, so wire it up on your user entity if it does not already expose one. See [Entities & persistence](docs/entities-and-persistence.md) and [Interface implementations](docs/interface-implementations.md). --- Features -------- [](#features) The bundle covers 16 security features. Each row maps the feature to the bundle primitives that power it — follow the link for the feature-level narrative, config options and defaults. FeatureBundle primitivesDocPassword Policy`PasswordPolicy` constraint + `PasswordPolicyFilteringValidator`[password-policy](docs/features/password-policy.md)Password History`PasswordHistory` constraint + `PasswordSimilarityChecker`[password-history](docs/features/password-history.md)Password Expiration`PasswordExpirationChecker` + user mixins[password-expiration](docs/features/password-expiration.md)Password Change Notifications`password_change_notification.enabled` settings toggle (notification is app-level)[password-change-notifications](docs/features/password-change-notifications.md)Two-Factor AuthenticationTOTP / QR / recovery generators + enforcement checker + flow controllers[two-factor-authentication](docs/features/two-factor-authentication.md)3rd-party OAuth (Social Login)provider registry + Google/Apple/Microsoft + auto-registration policy + confirm-link code challenge (generator + validator)[oauth-social-login](docs/features/oauth-social-login.md)Magic Link Logintoken generator/validator + timing padding + flow controllers[magic-link-login](docs/features/magic-link-login.md)Passkey Login (WebAuthn/FIDO2)WebAuthn serializer + validator factories + flow controllers[passkey-login](docs/features/passkey-login.md)Account Lockout & Rate Limiting`LockoutPolicy` + `RateLimitGuard` + `DynamicRateLimiterFactory`[account-lockout-rate-limiting](docs/features/account-lockout-rate-limiting.md)Session Management & Login Notificationssession tracker + fingerprint + UA parser + GeoIP[session-management-login-notifications](docs/features/session-management-login-notifications.md)Centralized Security Settings UIsettings provider/writer contracts + feature toggle + policy factory[centralized-security-settings-ui](docs/features/centralized-security-settings-ui.md)Self-Service Account Deletion (GDPR)grace-period calculator + due-deletions processor + anonymizer contract[account-deletion-gdpr](docs/features/account-deletion-gdpr.md)Admin IP Whitelist`CidrMatcher` + `CidrList` constraint + IP restriction listener[admin-ip-whitelist](docs/features/admin-ip-whitelist.md)Admin IP Blacklistsame IP restriction primitives (global deny list)[admin-ip-blacklist](docs/features/admin-ip-blacklist.md)Admin Customer Managementsession / lockout / password primitives[admin-customer-management](docs/features/admin-customer-management.md)Password Login Control`AbstractPasswordLoginCheckListener` (scope-wide toggle)[password-login](docs/features/password-login.md)--- Requirements ------------ [](#requirements) - PHP 8.3+ - Symfony 6.4 or 7.4 - A Doctrine ORM (the bundle itself has no ORM dep, but your app needs one to persist sessions, passkey credentials, magic-link tokens, etc.) - A user entity implementing `Symfony\Component\Security\Core\User\UserInterface` --- Installation ------------ [](#installation) ``` composer require 3brs/enterprise-security-bundle ``` Then register the bundle in `config/bundles.php`: ``` return [ // ... your existing bundles Scheb\TwoFactorBundle\SchebTwoFactorBundle::class => ['all' => true], ThreeBRS\EnterpriseSecurityBundle\ThreeBRSEnterpriseSecurityBundle::class => ['all' => true], ]; ``` The bundle requires `scheb/2fa-bundle` for the 2FA flows; `composer require` pulls it in automatically. --- Integration guide ----------------- [](#integration-guide) The bundle is contract-first: you wire each feature you want. These pages walk through it (start at the top — each builds on the previous): GuideCovers[Configuration](docs/configuration.md)Rate-limiter cache pool, settings store, feature-flag defaults, required scalar parameters[Entities & persistence](docs/entities-and-persistence.md)User-entity mixins + the Doctrine records/repositories you provide[Interface implementations](docs/interface-implementations.md)The contracts you implement — with full reference impls (settings, magic-link, passkey)[Controllers](docs/controllers.md)Extending the abstract flow controllers + the full shipped-controller reference + security checklist[Controllers your app must provide](docs/controllers-you-provide.md)UI pieces intentionally not abstracted (settings UI, force-password-change, recovery-codes page, GDPR cron, …)[Routes reference](docs/routes.md)Every controller, its verb and a sample path[Symfony security configuration](docs/security-configuration.md)Firewall / `scheb_2fa` / OAuth provider wiring[Passkey front-end](docs/passkey-frontend.md)The browser-side WebAuthn JavaScript[Templates & translations](docs/templates-and-translations.md)Template variables, Twig extensions, translation domains--- Running tests ------------- [](#running-tests) The bundle is self-contained — clone it, install its own deps, and run the tooling directly (no Docker required): ``` composer install vendor/bin/phpunit # 326 unit tests (services + abstract controllers) vendor/bin/phpstan analyse # level max, generics + symfony extensions vendor/bin/ecs check # coding standard (--fix to apply) ``` --- Using this bundle on Sylius --------------------------- [](#using-this-bundle-on-sylius) Building a [Sylius](https://sylius.com) store? You don't need to wire any of this by hand — the [ThreeBRS Enterprise Security Plugin](https://github.com/3BRS/sylius-enterprise-security-plugin) implements the ready-made Sylius UI on top of this bundle. --- Changelog & upgrading ------------------------- [](#changelog--upgrading) See [CHANGELOG.md](CHANGELOG.md) for the release history and [UPGRADE.md](UPGRADE.md) for version-to-version migration steps. --- License ------- [](#license) MIT License. See [LICENSE](./LICENSE) for details. Credits ------- [](#credits) Developed by [3BRS](https://3brs.com) ### Health Score 46 — FairBetter than 92% of packages Maintenance97 Actively maintained with recent releases Popularity16 Limited adoption so far Community9 Small or concentrated contributor base Maturity52 Maturing project, gaining track record Bus Factor2 2 contributors hold 50%+ of commits How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window. **Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores. **Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement. **Maturity (30%)** — Project age, version count, PHP version support, and release stability. ### Release Activity Cadence Every ~9 days Total 4 Last Release 16d ago Major Versions v1.1.0 → v2.0.02026-07-02 ### Community Maintainers ![](https://www.gravatar.com/avatar/ab23998c28b111996e4b3357f20929d6904a97ac21724750e1dfafd6a09791e4?d=identicon)[ondrej-kuhnel](/maintainers/ondrej-kuhnel) --- Top Contributors [![FilipHoracek](https://avatars.githubusercontent.com/u/231852167?v=4)](https://github.com/FilipHoracek "FilipHoracek (4 commits)")[![FapLipos](https://avatars.githubusercontent.com/u/210017008?v=4)](https://github.com/FapLipos "FapLipos (3 commits)")[![ondrej-kuhnel](https://avatars.githubusercontent.com/u/6840281?v=4)](https://github.com/ondrej-kuhnel "ondrej-kuhnel (2 commits)") ### Code Quality TestsPHPUnit Static AnalysisPHPStan Code StyleECS Type Coverage Yes ### Embed Badge ![Health badge](/badges/3brs-enterprise-security-bundle/health.svg) ``` [![Health](https://phpackages.com/badges/3brs-enterprise-security-bundle/health.svg)](https://phpackages.com/packages/3brs-enterprise-security-bundle) ``` ### Alternatives [chameleon-system/chameleon-base The Chameleon System core. 1028.7k5](/packages/chameleon-system-chameleon-base)[contao/core-bundle Contao Open Source CMS 1231.6M2.9k](/packages/contao-core-bundle)[open-dxp/opendxp Content & Product Management Framework (CMS/PIM) 9421.6k64](/packages/open-dxp-opendxp)[sylius/sylius E-Commerce platform for PHP, based on Symfony framework. 8.5k5.9M756](/packages/sylius-sylius)[shopware/core Shopware platform is the core for all Shopware ecommerce products. 585.6M608](/packages/shopware-core)[oro/platform Business Application Platform (BAP) 645143.5k116](/packages/oro-platform) PHPackages © 2026 [Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)