--- title: New in Symfony 8.2: Security Expressions Everywhere... description: Symfony 8.2 extends security expression functions like is_granted() and is_authenticated() to more places, including validation constraints and controller... canonical: https://daily.dev/posts/new-in-symfony-8-2-security-expressions-everywhere-symfony-blog--pkpcesk3s twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: New in Symfony 8.2: Security Expressions Everywhere (Symfony Blog) | daily.dev og:description: Symfony 8.2 extends security expression functions like is_granted() and is_authenticated() to more places, including validation constraints and controller... og:url: https://daily.dev/posts/new-in-symfony-8-2-security-expressions-everywhere-symfony-blog--pkpcesk3s og:image: https://api.daily.dev/og/posts/pkPcESk3S.png og:image:alt: New in Symfony 8.2: Security Expressions Everywhere (Symfony Blog) og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # New in Symfony 8.2: Security Expressions Everywhere (Symfony Blog) **[Symfony](https://daily.dev/sources/symfony)** · 3 min read · 0 upvotes · 0 comments ## Summary Symfony 8.2 extends security expression functions like is_granted() and is_authenticated() to more places, including validation constraints and controller attributes. The Expression and When validation constraints can now call these functions, letting rules differ by role, such as limiting a blog post summary to 280 characters unless the user has ROLE_EDITOR. A new current_user() function returns the logged-in user or null, usable in validation and in #[RateLimit] or #[MapRequestPayload] expressions without injecting a #[CurrentUser] argument. The upcoming DoctrineBundle 3.4 will let current_user() be passed into #[MapEntity] expressions, such as repository.findLatestByCustomer(current_user()). Note: these functions throw an exception if evaluated outside a request, such as in a console command or Messenger worker. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I use is_granted() inside a Symfony validation constraint? In Symfony 8.2, the Expression and When validation constraints can call is_granted(), is_authenticated(), is_fully_authenticated(), and is_remember_me() when both the Validator and Security components are used. For example, wrapping an Assert\Length(max: 280) constraint in an Assert\When with expression 'not is_granted("ROLE_EDITOR")' exempts editors from the length limit. These functions only work inside a request and throw an exception if evaluated in a console command or Messenger worker. _Teams rolling out role-based validation rules can track Symfony 8.2 changes like this on daily.dev._ ### What does the new current_user() function do in Symfony 8.2? current_user() is a new expression function that returns the currently authenticated user object, or null if nobody is logged in. It can be used in validation constraints, such as preventing a user from inviting their own email with the expression 'value != current_user()?.getEmail()', and in controller attributes like #[RateLimit] without needing a separate #[CurrentUser] argument. _daily.dev helps developers adopting new Symfony 8.2 expression features stay current on the changes._ ### Can I access the current user in a Symfony #[RateLimit] attribute without injecting #[CurrentUser]? Yes, in Symfony 8.2 you can call current_user() directly inside the key option of #[RateLimit], for example key: new Expression('current_user().getUserIdentifier()'), instead of adding a #[CurrentUser] User $user argument you never use in the method body. The upcoming DoctrineBundle 3.4 extends the same current_user() function to #[MapEntity] expressions. _Developers refactoring controller attributes can follow Symfony's expression language updates on daily.dev._ ## Similar posts on daily.dev - [New in Symfony 8.2: Sudo Mode \(Symfony Blog\)](https://daily.dev/posts/new-in-symfony-8-2-sudo-mode-symfony-blog--tu9o6qvlh) · Symfony · 2 upvotes · 0 comments - [New in Symfony 8.2: EntityExists, Cron and Audio Constraints \(Symfony Blog\)](https://daily.dev/posts/new-in-symfony-8-2-entityexists-cron-and-audio-constraints-symfony-blog--7wv3tvp8a) · Symfony · 1 upvotes · 0 comments - [New in Symfony 7.4: Attribute Improvements \(Symfony Blog\)](https://daily.dev/posts/new-in-symfony-7-4-attribute-improvements-symfony-blog--0dftx5qrt) · Symfony · 0 upvotes · 0 comments - [New in Symfony 8.2: Locking Controllers \(Symfony Blog\)](https://daily.dev/posts/new-in-symfony-8-2-locking-controllers-symfony-blog--mkwvfc60j) · Symfony · 14 upvotes · 0 comments --- Tags: [#php](https://daily.dev/tags/php), [#authentication](https://daily.dev/tags/authentication), [#symfony](https://daily.dev/tags/symfony) [View this post on daily.dev](https://daily.dev/posts/new-in-symfony-8-2-security-expressions-everywhere-symfony-blog--pkpcesk3s) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"New in Symfony 8.2: Security Expressions Everywhere (Symfony Blog)","url":"https://daily.dev/posts/new-in-symfony-8-2-security-expressions-everywhere-symfony-blog--pkpcesk3s","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/new-in-symfony-8-2-security-expressions-everywhere-symfony-blog--pkpcesk3s"},"datePublished":"2026-10-28T09:31:27.850Z","dateModified":"2026-10-28T09:34:34.498Z","description":"Symfony 8.2 extends security expression functions like is_granted() and is_authenticated() to more places, including validation constraints and controller...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/327b244859fddae8f3a20d0225898aa0?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/327b244859fddae8f3a20d0225898aa0?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Symfony","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Symfony","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/cc07051b7112472f9729e73c14660a64","url":"https://daily.dev/sources/symfony"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/new-in-symfony-8-2-security-expressions-everywhere-symfony-blog--pkpcesk3s","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"php,authentication,symfony","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Symfony","item":"https://daily.dev/sources/symfony"},{"@type":"ListItem","position":3,"name":"New in Symfony 8.2: Security Expressions Everywhere (Symfony Blog)"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/new-in-symfony-8-2-security-expressions-everywhere-symfony-blog--pkpcesk3s#faq","mainEntity":[{"@type":"Question","name":"How do I use is_granted() inside a Symfony validation constraint?","acceptedAnswer":{"@type":"Answer","text":"In Symfony 8.2, the Expression and When validation constraints can call is_granted(), is_authenticated(), is_fully_authenticated(), and is_remember_me() when both the Validator and Security components are used. For example, wrapping an Assert\\Length(max: 280) constraint in an Assert\\When with expression 'not is_granted(\"ROLE_EDITOR\")' exempts editors from the length limit. These functions only work inside a request and throw an exception if evaluated in a console command or Messenger worker. Teams rolling out role-based validation rules can track Symfony 8.2 changes like this on daily.dev."}},{"@type":"Question","name":"What does the new current_user() function do in Symfony 8.2?","acceptedAnswer":{"@type":"Answer","text":"current_user() is a new expression function that returns the currently authenticated user object, or null if nobody is logged in. It can be used in validation constraints, such as preventing a user from inviting their own email with the expression 'value != current_user()?.getEmail()', and in controller attributes like #[RateLimit] without needing a separate #[CurrentUser] argument. daily.dev helps developers adopting new Symfony 8.2 expression features stay current on the changes."}},{"@type":"Question","name":"Can I access the current user in a Symfony #[RateLimit] attribute without injecting #[CurrentUser]?","acceptedAnswer":{"@type":"Answer","text":"Yes, in Symfony 8.2 you can call current_user() directly inside the key option of #[RateLimit], for example key: new Expression('current_user().getUserIdentifier()'), instead of adding a #[CurrentUser] User $user argument you never use in the method body. The upcoming DoctrineBundle 3.4 extends the same current_user() function to #[MapEntity] expressions. Developers refactoring controller attributes can follow Symfony's expression language updates on daily.dev."}}]} ```