Comments on: Implementing email login with sfGuardPlugin

By: Laurent

Laurent — Sun, 04 Sep 2011 05:35:16 +0000

Thank you very much for this great article !

By: Sid

Sid — Fri, 12 Jun 2009 01:07:38 +0000

I’m about to write one for Symfony 1.2 and Propel (sorry Doctrine, will be a wee while till I switch)

It turned out that implementing this in 1.2 is very different than 1.0. Stay tuned.

By: Matthew

Matthew — Thu, 11 Jun 2009 23:16:14 +0000

@Justin Davis @Sid Any updates on this?

By: Sid

Sid — Wed, 03 Jun 2009 23:20:30 +0000

Hi, I have not done this method with Doctrine. But I’m working on an article for Symfony 1.2 and Propel.

By: Justin Davis

Justin Davis — Tue, 05 May 2009 18:42:20 +0000

Thanks for this! I’m working on implementing it (with Symfony 1.2/Doctrine) and am just having problems overriding the standard sfGuardAuth config. I put the signin.yml file in the directory you specified, but it appears that it’s still attempting to validate against username, instead of email.

Thoughts?

By: jerome

jerome — Wed, 29 Apr 2009 21:56:05 +0000

Ok, you made the point ;-)

The word “secure” was not correct, sorry. What I wanted to say is : what is your randomly generate username (10 characters of first name, 3 characters of last name, and a 3-digits random number) was already used by someone else?

Hum, I didn’t see that you try another random. Damn, sorry, I was wrong all the lines :-)

By: Sid

Sid — Wed, 29 Apr 2009 21:31:31 +0000

@jeromev

I’m not aware of any ‘security’ problem with randomly generated username.

Storing email in username field is a potential security and privacy issue. This is because username and email are two columns of different purposes.

Username tend to be displayed publicly, while email should never be displayed publicly. If you store email in username field, you have to be really careful when using other plugins that depend on sfGuardPlugin, because chances are, they’d display the email stored in username field publicly.

It is also not ‘natural’ to code things like: $this->sendEmailTo($user->getUsername());

Try to use sfGuardPlugin and sfSimpleForum, and store email in username field, and you’ll understand what I mean.

By: jeromev

jeromev — Wed, 29 Apr 2009 13:43:27 +0000

Hello!

Thanks for this howto.

But, why not store the email in the username field? I think that’s more “secure” than using a random string.