Frozen snapshot, not a maintained package, not the official split repository.

This repository holds the symfony/security-http directory of welcoMattic/symfony@oidc-login-tuning, the head of the 7-PR stack that adds a native OpenID Connect Authorization Code Flow authenticator (oidc_login) to Symfony. Umbrella PR: symfony/symfony#64954.

It exists for one reason: letting a demo application install the branch with Composer while the PRs are still under review. Symfony forbids requiring symfony/symfony from an application, and the official split repositories only carry merged code.

{
    "repositories": [
        {"type": "vcs", "url": "https://github.com/welcoMattic/security-http"}
    ],
    "require": {
        "symfony/security-http": "dev-demo-apiplatformcon-2026 as 8.2.x-dev"
    }
}

The branch demo-apiplatformcon-2026 is deliberately frozen: rebasing the PR stack must not break the demo given at API Platform Con 2026. Once the PRs are merged, use the official symfony/security-http package instead.

The Security HTTP component provides an HTTP integration of the Security Core component. It allows securing (parts of) your application using firewalls and provides authenticators to authenticate visitors.

composer require symfony/security-http

The Security component for Symfony 8.1 is backed by SymfonyCasts.

Learn Symfony faster by watching real projects being built and actively coding along with them. SymfonyCasts bridges that learning gap, bringing you video tutorials and coding challenges. Code on!

Help Symfony by sponsoring its development!

• Documentation
• Contributing
• Report issues and send Pull Requests in the main Symfony repository