Chapters

37 Chapters | 3:43:31 |

01

API Docs on Production?

8:22
02

API Tokens? Session Cookies?

8:07
03

API Login Form with json_login

5:36
04

Handling Authentication Errors

3:47
05

On Authentication Success

6:03
06

Logout & Passing API Data to JavaScript

5:45
07

Passing Values to Stimulus

4:32
08

Token Types & The ApiToken Entity

5:59
09

Generating the API Token & Fixtures

5:58
10

Access Token Authenticator

8:56
11

Customizing the OpenAPI Docs

7:31
12

API Token Scopes

5:51
13

Deny Access with The "security" Option

7:11
14

Bootstrapping a Killer Test System

8:18
15

JSON Test Assertions & Seeding the Database

3:41
16

Advanced & Flexible JSON Test Assertions

4:04
17

Testing Authentication

4:59
18

Customizing Browser Globally

3:50
19

Testing Token Authentication

3:24
20

New PUT Behavior

4:46
21

Only Allow Owners to Edit

7:49
22

Allow Admin Users to Edit any Treasure

4:11
23

Security Voter

6:13
24

Conditional Fields by User: ApiProperty

5:13
25

User Test + Plain Password

4:21
26

State Processors: Hashing the User Password

6:55
27

Validation Groups & Patch Formats

8:01
28

Dynamic Groups: Context Builder

8:26
29

Custom Normalizer

5:08
30

Normalizer Decoration & "Normalizer Aware"

6:29
31

Totally Custom Fields

3:24
32

Custom Validator

7:58
33

Validating how Values Change

8:30
34

Auto Setting the "owner"

4:19
35

Query Extension: Auto-Filter a Collection

6:15
36

404 On Unpublished Items

8:00
37

Filtering Relation Collection

5:39

> APIs > API Platform 3 Part 2: Security for your Treasures

Buy Access to Course

33.

Validating how Values Change

|

|

Autoplay

Keep on Learning!

If you liked what you've learned so far, dive in! Subscribe to get
access to this tutorial plus video, code and script downloads.

Start your All-Access Pass

Buy just this tutorial for $12.00

Previous Chapter

Next Chapter

With a Subscription, click any sentence in the script to jump to that part of the video!

Login Subscribe

Login or register to check out the script

7 Comments

Sort By

Login or Register to join the conversation

Michel 3 years ago

I think the return in the foreach loop should be a continue. Otherwise it will only check if the owner of the first dragon treasure is correct and if so, it will not check the other dragon treasures.

5 |

MolloKhan SFCASTS Michel 3 years ago edited

Hey @Michel

You're right, it won't check any other DragonTreasures, however, that's a problem only if you allow updating multiple objects at once, which we don't currently support. So, for now, it will just work :)

Cheers!

1 |

schizy 1 year ago edited

For the problem addressed by Michel (1 year ago xD) I did this :

public function testTreasuresCannotBeStolen(): void
    {
        $randomDragon = UserFactory::createOne();
        $hisTreasure = DragonTreasureFactory::createOne(['owner' => $randomDragon]);
        $DefinitelyNotHisTreasure = DragonTreasureFactory::createOne();

        $this->browser()
            ->actingAs($randomDragon)
            ->patchWithHeader('/api/users/' . $randomDragon->getId(), [
                'json' => [
                    'username' => 'changed',
                    'dragonTreasures' => [
                        '/api/treasures/' . $hisTreasure->getId(),
                        '/api/treasures/' . $DefinitelyNotHisTreasure->getId(),
                    ],
                ]
            ])
            ->assertStatus(422);
    }

With this validator :

$hasTriedToSteel = false;
        foreach ($value as $dragonTreasure) {
            $originalData = $this->entityManager->getUnitOfWork()->getOriginalEntityData($dragonTreasure);

            if (!$originalData['owner_id'] || $originalData['owner_id'] === $dragonTreasure->getOwner()?->getId()) {
                continue;
            }

            $hasTriedToSteel = true;
            break;
        }

        if ($hasTriedToSteel) {
            $this->context->buildViolation($constraint->message)->addViolation();
        }

Without changing the validator, the user was able to steal a treasure in my case!

(Maybe I missed something but I don't have any limitation on the number of treasures sent here)

|

Victor SFCASTS schizy 1 year ago edited

Thanks for sharing your solution with others! I think we can ping @Michel too as he might be interested in checking it :)

Cheers!

1 |

Manuel-B 2 years ago

Hi! Would it also be secure to remove the 'user:write' group on the user property of DragonTreasure?

|

weaverryan SFCASTS Manuel-B 2 years ago

Hey @Manuel-B!

Yup and that's a much simpler solution. It means: "Hey! If you want to change the owner of a dragon treasure, then change it ON the dragon treasure endpoints, not through the user". If you don't NEED to have user.dragonTreasures writable, it's much simpler to remove that.

Cheers!

1 |

Manuel-B weaverryan 2 years ago

Lovely, thanks!

|

API Platform 3 Symfony 6.2

What PHP libraries does this tutorial use?

// composer.json
{
    "require": {
        "php": ">=8.2",
        "ext-ctype": "*",
        "ext-iconv": "*",
        "api-platform/core": "^3.0", // v3.1.2
        "doctrine/annotations": "^2.0", // 2.0.1
        "doctrine/doctrine-bundle": "^2.8", // 2.8.3
        "doctrine/doctrine-migrations-bundle": "^3.2", // 3.2.2
        "doctrine/orm": "^2.14", // 2.14.1
        "nelmio/cors-bundle": "^2.2", // 2.2.0
        "nesbot/carbon": "^2.64", // 2.66.0
        "phpdocumentor/reflection-docblock": "^5.3", // 5.3.0
        "phpstan/phpdoc-parser": "^1.15", // 1.16.1
        "symfony/asset": "6.2.*", // v6.2.5
        "symfony/console": "6.2.*", // v6.2.5
        "symfony/dotenv": "6.2.*", // v6.2.5
        "symfony/expression-language": "6.2.*", // v6.2.5
        "symfony/flex": "^2", // v2.2.4
        "symfony/framework-bundle": "6.2.*", // v6.2.5
        "symfony/property-access": "6.2.*", // v6.2.5
        "symfony/property-info": "6.2.*", // v6.2.5
        "symfony/runtime": "6.2.*", // v6.2.5
        "symfony/security-bundle": "6.2.*", // v6.2.6
        "symfony/serializer": "6.2.*", // v6.2.5
        "symfony/twig-bundle": "6.2.*", // v6.2.5
        "symfony/ux-react": "^2.6", // v2.7.1
        "symfony/ux-vue": "^2.7", // v2.7.1
        "symfony/validator": "6.2.*", // v6.2.5
        "symfony/webpack-encore-bundle": "^1.16", // v1.16.1
        "symfony/yaml": "6.2.*" // v6.2.5
    },
    "require-dev": {
        "doctrine/doctrine-fixtures-bundle": "^3.4", // 3.4.2
        "mtdowling/jmespath.php": "^2.6", // 2.6.1
        "phpunit/phpunit": "^9.5", // 9.6.3
        "symfony/browser-kit": "6.2.*", // v6.2.5
        "symfony/css-selector": "6.2.*", // v6.2.5
        "symfony/debug-bundle": "6.2.*", // v6.2.5
        "symfony/maker-bundle": "^1.48", // v1.48.0
        "symfony/monolog-bundle": "^3.0", // v3.8.0
        "symfony/phpunit-bridge": "^6.2", // v6.2.5
        "symfony/stopwatch": "6.2.*", // v6.2.5
        "symfony/web-profiler-bundle": "6.2.*", // v6.2.5
        "zenstruck/browser": "^1.2", // v1.2.0
        "zenstruck/foundry": "^1.26" // v1.28.0
    }
}

Previous Chapter

Next Chapter