Chapters

37 Chapters | 3:43:31 |

01

¿Documentos API en producción?

8:22
02

¿Token API? ¿Cookies de sesión?

8:07
03

Formulario de inicio de sesión API con json_login

5:36
04

Manejo de errores de autenticación

3:47
05

En Autenticación correcta

6:03
06

Cerrar sesión y pasar datos de la API a JavaScript

5:45
07

Pasar valores a Stimulus

4:32
08

Tipos de token y la entidad ApiToken

5:59
09

Generar el token de la API y los accesorios

5:58
10

Autenticador de token de acceso

8:56
11

Personalizar los documentos de OpenAPI

7:31
12

Ámbitos de los tokens de la API

5:51
13

Denegar el acceso con la opción "seguridad

7:11
14

Poner en marcha un sistema de pruebas asesino

8:18
15

Aserciones de la prueba JSON y siembra de la base de datos

3:41
16

Aserciones de prueba JSON avanzadas y flexibles

4:04
17

Probar la autenticación

4:59
18

Personalizar el navegador globalmente

3:50
19

Probar la autenticación por token

3:24
20

Nuevo comportamiento PUT

4:46
21

Permitir editar sólo a los propietarios

7:49
22

Permitir que los usuarios administradores editen cualquier tesoro

4:11
23

Votante de seguridad

6:13
24

Campos condicionales por usuario: ApiProperty

5:13
25

Prueba de Usuario + Contraseña Simple

4:21
26

Procesadores de Estado: Hashing de la contraseña de usuario

6:55
27

Grupos de validación y formatos de parche

8:01
28

Grupos Dinámicos: Creador de Contextos

8:26
29

Normalizador personalizado

5:08
30

Decoración del normalizador y "Normalizer Aware" (consciente del normalizador)

6:29
31

Campos totalmente personalizados

3:24
32

Validador personalizado

7:58
33

Validar cómo cambian los valores

8:30
34

Configuración automática del "propietario

4:19
35

Extensión de consulta: Autofiltrar una colección

6:15
36

404 En Artículos No Publicados

8:00
37

Filtrar la colección de relaciones

5:39

> APIs > API Platform 3: Seguridad para tus tesoros

Buy Access to Course

01.

¿Documentos API en producción?

|

|

Autoplay

Next Chapter

Login or register to check out the script

22 Comments

Sort By

Login or Register to join the conversation

CDesign 1 year ago

This is a minor point but might help someone out. On MacOS Docker v4.0 and later, the docker-compose command is now integrated into the CLI. So instead of running docker-compose up -d you run docker composer up -d. Not sure if the same change was made on Windows. Maybe someone can add that note to the README.md file. Thx!

1 |

Victor SFCASTS CDesign 1 year ago edited

Hey @CDesign ,

Thanks for this tip! Yeah, we even have a note somewhere in the course about it :)

Cheers!

|

sukhoy94 2 years ago

Hello,

I've got a problem here. I downloaded a source code, installed composer and npm, but after symfony serve I've got that kind of error:

Attempted to load class "Locale" from the global namespace.<br />Did you forget a "use" statement for "Symfony\Component\Validator\Constraints\Locale"?

The solution is to install intl extension and to enable it in your php.ini :) Hope it will help anyone who will issues the same issue in the future, thanks

1 |

MolloKhan SFCASTS sukhoy94 2 years ago

Hey sukhoy,

Yes, you're right, that error confuses more than it helps. Thanks for sharing your solution!

|

Oleh-K 3 years ago edited HIGHLIGHTED

About environment varibale to disable docs (at 7:56).
As far as i know it is not possible for now, as api_platform config loaded during a compile time. So it is has not picked up ENV variables, and next configuration does not work:

api_platform:
   enable_swagger: '%env(bool:ENABLE_API_DOCS)%'
   # .... and other disablings

My current sollution, is:

when@prod:
  api_platform:
    enable_swagger: false
    # .... and other disablings

So if you know the solution how to do that with Environment varibales. Please share.

1 |

weaverryan SFCASTS Oleh-K 3 years ago

Hey @Oleh-K!

Ah, you're right! I was assuming too much! The APIPlatform Symfony integration references those variables at compile time (like you said). That would need to be fixed inside API Platform, but actually, I think it's not reasonably fixable. By setting, for example, enable_swagger to false, a set of services is removed from the container (which is good - no reason to have those extra service around if they're not used). It would be a decent bit of work to allow this config to use environment variables, and the end result is that people who do want to disable them would still have these extra services "available" in the container, even though they're not used. Not a huge deal, but also probably a good reason not to "fix it".

Anyway, I appreciate you pointing this out! I'll add a note to the course.

Cheers!

1 |

Oleh-K weaverryan 3 years ago

Anyway, thank you very much! I've found many helpful things in your course.

|

ToNy 2 years ago

Is there a way to show an endpoint only to a specific role?

|

MolloKhan SFCASTS ToNy 2 years ago edited

Hey @ToNy

Yes, you can check for the user's role inside your controller's method, or you can use the #[IsGranted()] attribute. Reference to the docs: https://symfony.com/doc/current/security.html#security-securing-controller-attributes

Cheers!

1 |

ToNy MolloKhan 2 years ago

Thanks for your reply! I'm affraid that Iphrased my question poorly, so I'll start again. I'm protecting the /api route using access_control in security.yaml, so only authenticated users can access the docs. I want to know if, instead of showing all the endpoints in the docs (swagger or redoc), show only the ones that the user has access to, based on the user roles and the security of the entity declared in the ApiResource annotation.

|

weaverryan SFCASTS ToNy 2 years ago

Hey @ToNy!

I think I understand and it seems reasonable. But it can be tricky to pull off. We talk about something kind of similar in an API Platform 2 tutorial - https://symfonycasts.com/screencast/api-platform2-security/resource-metadata-factory

There, we are trying to add some extra serialization groups in a way that our API docs will notice. You may be able to extend this to dynamically add groups based on the currently-authenticated user.

Another option might be to decorate and customize the OpenApiFactory - perhaps removing resources based on the current user- https://symfonycasts.com/screencast/api-platform-security/open-api-decoration

Let me know if any of these are successful.

Cheers!

|

Jamezs 2 years ago edited

Apart from the fact that I need to undo the changes made at the end. Did you notice that the frontend doesn't work with the documentation disabled?

An exception has been thrown during the rendering of a template ("Unable to generate a URL for the named route "api_entrypoint" as such route does not exist.").

|

weaverryan SFCASTS Jamezs 2 years ago

Hey @Jamezs!

I believe you're referring to the homepage of the app, right? If so, yea, that's expected - but that's just due to how I built the app :). That custom homepage I built references the api_entrypoint route so that it can link to the API homepage. So in a real app, if you disabled the docs, as long as you didn't try to link to this route, you'd be good ;).

Cheers!

|

Fran 3 years ago

Hello!
I have a question about how you did the initial login, since it appears created directly in the video, are you creating it through make:controller login? If not, could I create it this way?

|

weaverryan SFCASTS Fran 3 years ago

Hey @Fran!

At the start of this tutorial, the frontend and login stuff is pretty simple. It's a MainController::homepage() that renders main/homepage.html.twig (and that controller is dead-simple). The template itself is pretty much empty except that it renders a Vue app, which renders the login form. All of that was created by hand. The controller and template and very simple and small (you could definitely use make:controller to get this), but I created the Vue app by hand.

In a normal Symfony app, I would probably build my login form directly in PHP & Twig. For that, I'd use make:auth and choose the "login form" option. That will generate you the controller & template for the login form + a few other things.

Does that help? Let me know!

Cheers!

|

Klaus-M 3 years ago

Short question, the editor in use is Phpstrorm? Is this a special skin?

|

MolloKhan SFCASTS Klaus-M 3 years ago edited

Hey @Klaus-M

Yes, it is PhpStorm, and I believe Ryan uses the "Atom Material Icons" plugin to enhance his editor's theme

Cheers!

|

Klaus-M MolloKhan 3 years ago

Yes, that's it. Thank you very much.

Cheers!

|

pasquale_pellicani 3 years ago

I also ask the same question here, part 2 ok and what would part 1 be ? Thank you

|

Victor SFCASTS pasquale_pellicani 3 years ago edited

Hey @pasquale_pellicani ,

I'm not sure I understand the question :)

I also ask the same question here

What who else is asking here and what exactly? I see only your comment on this page :)

But in case you're looking for part 1, here it is: https://symfonycasts.com/screencast/api-platform .

Cheers!

|

pasquale_pellicani Victor 3 years ago

Thank you very much, it would be ideal to change the title of the courses with part 1 and part 2 because I had difficulty understanding the order of the two courses. I take the opportunity to thank you for the excellent work done ;)

|

Victor SFCASTS pasquale_pellicani 3 years ago edited

Hey @pasquale_pellicani ,

I see, yeah, it might not be clear enough. I'd try to add cross-link to this course. Also, you can always can look at the track to find the related courses and the correct order: https://symfonycasts.com/tracks/rest#api-platform-3

I hope this helps!

Cheers!

|

API Platform 3 Symfony 6.2

What PHP libraries does this tutorial use?

// composer.json
{
    "require": {
        "php": ">=8.2",
        "ext-ctype": "*",
        "ext-iconv": "*",
        "api-platform/core": "^3.0", // v3.1.2
        "doctrine/annotations": "^2.0", // 2.0.1
        "doctrine/doctrine-bundle": "^2.8", // 2.8.3
        "doctrine/doctrine-migrations-bundle": "^3.2", // 3.2.2
        "doctrine/orm": "^2.14", // 2.14.1
        "nelmio/cors-bundle": "^2.2", // 2.2.0
        "nesbot/carbon": "^2.64", // 2.66.0
        "phpdocumentor/reflection-docblock": "^5.3", // 5.3.0
        "phpstan/phpdoc-parser": "^1.15", // 1.16.1
        "symfony/asset": "6.2.*", // v6.2.5
        "symfony/console": "6.2.*", // v6.2.5
        "symfony/dotenv": "6.2.*", // v6.2.5
        "symfony/expression-language": "6.2.*", // v6.2.5
        "symfony/flex": "^2", // v2.2.4
        "symfony/framework-bundle": "6.2.*", // v6.2.5
        "symfony/property-access": "6.2.*", // v6.2.5
        "symfony/property-info": "6.2.*", // v6.2.5
        "symfony/runtime": "6.2.*", // v6.2.5
        "symfony/security-bundle": "6.2.*", // v6.2.6
        "symfony/serializer": "6.2.*", // v6.2.5
        "symfony/twig-bundle": "6.2.*", // v6.2.5
        "symfony/ux-react": "^2.6", // v2.7.1
        "symfony/ux-vue": "^2.7", // v2.7.1
        "symfony/validator": "6.2.*", // v6.2.5
        "symfony/webpack-encore-bundle": "^1.16", // v1.16.1
        "symfony/yaml": "6.2.*" // v6.2.5
    },
    "require-dev": {
        "doctrine/doctrine-fixtures-bundle": "^3.4", // 3.4.2
        "mtdowling/jmespath.php": "^2.6", // 2.6.1
        "phpunit/phpunit": "^9.5", // 9.6.3
        "symfony/browser-kit": "6.2.*", // v6.2.5
        "symfony/css-selector": "6.2.*", // v6.2.5
        "symfony/debug-bundle": "6.2.*", // v6.2.5
        "symfony/maker-bundle": "^1.48", // v1.48.0
        "symfony/monolog-bundle": "^3.0", // v3.8.0
        "symfony/phpunit-bridge": "^6.2", // v6.2.5
        "symfony/stopwatch": "6.2.*", // v6.2.5
        "symfony/web-profiler-bundle": "6.2.*", // v6.2.5
        "zenstruck/browser": "^1.2", // v1.2.0
        "zenstruck/foundry": "^1.26" // v1.28.0
    }
}

Next Chapter