Chapters

39 Chapters | 4:45:13 |

01

Hello API Security + API Docs on Production?

8:55
02

API Auth 101: Session? Cookies? Tokens?

4:05
03

Login with json_login

6:27
04

Authentication Errors

5:55
05

Login Success & the Session

4:28
06

On Authentication Success

7:40
07

Logout & Passing API Data to JS on Page Load

8:49
08

SameSite Cookies & CSRF Attacks

8:06
09

ApiResource access_control

6:03
10

Bootstrapping a Test Suite

4:29
11

Backport the API Platform 2.5 Test Tools

5:01
12

Api Tests & Assertions

6:51
13

Logging in Inside the Test

6:57
14

Resetting the Database Between Tests

4:51
15

Base Test Class full of Goodies

8:30
16

ACL: Only Owners can PUT a CheeseListing

9:23
17

ACL & previousObject

8:04
18

Access Control & Voters

8:25
19

Adding the plainPassword Field

7:31
20

Data Persister: Encoding the Plain Password

8:03
21

Validation Groups

5:44
22

Conditional Field Setup

6:42
23

Testing, Updating Roles & Refreshing Data

9:22
24

Context Builder & Service Decoration

6:50
25

Context Builder: Dynamic Fields/Groups

7:47
26

Automatic Serialization Groups

5:59
27

Resource Metadata Factory: Dynamic ApiResource Options

8:45
28

Dynamic Groups without Caching

10:34
29

Custom Normalizer: Object-by-Object Dynamic Fields

9:30
30

Diving into the Normalizer Internals

4:49
31

A "Normalizer Aware" Normalizer

6:49
32

Normalizer & Completely Custom Fields

7:32
33

Locking down the CheeseListing.owner Field

8:16
34

Custom Validator

5:40
35

Security Logic in the Validator

6:46
36

Auto-set the Owner: Entity Listener

9:46
37

Query Extension: Auto-Filter a Collection

9:37
38

Automatic 404 on Unpublished Items

5:26
39

Filtering Related Collections

10:50

This tutorial has a new version, check it out!

> Symfony 5 > API Platform 2 Part 2: Security

Buy Access to Course

17.

ACL & previousObject

|

Autoplay

Keep on Learning!

If you liked what you've learned so far, dive in! Subscribe to get
access to this tutorial plus video, code and script downloads.

Start your All-Access Pass

Buy just this tutorial for $12.00

Previous Chapter

Next Chapter

With a Subscription, click any sentence in the script to jump to that part of the video!

Login Subscribe

Login or register to check out the script

6 Comments

Sort By

Login or Register to join the conversation

Mykyta 3 years ago

Hey :)
I faced with the '401 Unauthorized' error while trying to create the User, so I thought it might be useful to write here about the way to fix it..
I find out that the new system (after Symfony v5.3) doesn't "authenticate" user by default with IS_AUTHENTICATED_ANONYMOUSLY, because anonymous users no longer exist. So in this case we should use is_granted('PUBLIC_ACCESS').
Cheers!

2 |

weaverryan SFCASTS Mykyta 3 years ago

Hey @Mykyta!

You're totally right! Once you switch to the new security system (enable_authenticator_manager: true in security.yaml in Symfony 5.3/5.4 and ALWAYS activated in Symfony 6.0 and beyond), IS_AUTHENTICATED_ANONYMOUSLY is gone and PUBLIC_ACCESS replaces it. I'll add a note about this!

Cheers!

1 |

Kiuega 5 years ago edited

Hello, in API Platform 2.5, so, which is the best solution between :


'put' => [
                'security_post_denormalize' => "is_granted('ROLE_USER') and previous_object.getOwner() == user",
                'security_post_denormalize_message' => 'Only the creator can edit a cheese listing'
            ],

and


'put' => [
                'securit' => "is_granted('ROLE_USER') and object.getOwner() == user",
                'security_message' => 'Only the creator can edit a cheese listing'
            ],

?

|

weaverryan SFCASTS Kiuega 5 years ago edited

Hey Kiuega!

Sorry for the slow reply - this message was waiting for me :).

Hmm. I think... these are identical. Though, I would go with the second one: if the object's current owner != the current user, then we already know with complete certainty that this operation should be stopped. Doing it the second way will avoid going through the deserialization process. So, it's a nice way to exit earlier and avoid unnecessary work. But unless I'm not thinking about something, in functional terms, these are identical.

Cheers!

1 |

Pavlo S. 5 years ago edited

There is something wrong, that doesn't work for me, I can't explain but found working solution. Can anyone explain?
Environment
<br />...<br />"php": ">=7.2.5",<br />"api-platform/core": "^2.5",<br />"symfony/framework-bundle": "5.1.*",<br />...<br />

NOT working <b>Entity/CheeseListing.php</b>
`
/**

@ApiResources(
...
itemOperations={
...
"put"={"security"=>"is_granted('ROLE_USER') and previous_object.getOwner() == user"}
...}
...
)
*/
`

Working <b>Entity/CheeseListing.php</b>, due to https://api-platform.com/docs/core/security/#executing-access-control-rules-after-denormalization
`
/**

@ApiResources(
...
itemOperations={
...
"put"={"security_post_denormalize"=>"is_granted('ROLE_USER') and previous_object.getOwner() == user"}
...
...}
)
*/
`

|

weaverryan SFCASTS Pavlo S. 5 years ago edited

Hey @the_shadow!

Sorry for the slow reply! This is a good topic :).

In our tutorial, which pre-dates the "security" attribute, we used:


"access_control"="is_granted('ROLE_USER') and previous_object.getOwner() == user",

In API Platform 2.5 and higher, as you know, we now have security and security_post_denormalize. Basically, access_control === security_post_denormalize. What I mean is, both of these run after denormalization, and so they work exactly the same. That's what you're seeing: you're passing the exact same expression to security_post_denormalize as I pass to access_control in this tutorial and it works. For both of these, previous_object is the object from before the JSON was deserialized and object is from after.

The difference between security and security_post_denormalize is that security runs before deserialization. In this situation, the object variable is the original object, before the JSON is deserialized. And there actually is no variable called previous_object.

I hope this explains what's going on! So, you can use your solution or use security but change the variable from previous_object to object. That second solution is technically a "bit" more correct, because it will deny access even before your JSON is deserialized.

Let me know if that helps!

Cheers!

|

This tutorial works great for Symfony 5 and API Platform 2.5/2.6.

Symfony 4 API Platform 2.4

What PHP libraries does this tutorial use?

// composer.json
{
    "require": {
        "php": "^7.1.3, <8.0",
        "ext-ctype": "*",
        "ext-iconv": "*",
        "api-platform/core": "^2.1", // v2.4.5
        "composer/package-versions-deprecated": "^1.11", // 1.11.99
        "doctrine/annotations": "^1.0", // 1.13.2
        "doctrine/doctrine-bundle": "^1.6", // 1.11.2
        "doctrine/doctrine-migrations-bundle": "^2.0", // v2.0.0
        "doctrine/orm": "^2.4.5", // v2.7.2
        "nelmio/cors-bundle": "^1.5", // 1.5.6
        "nesbot/carbon": "^2.17", // 2.21.3
        "phpdocumentor/reflection-docblock": "^3.0 || ^4.0", // 4.3.1
        "symfony/asset": "4.3.*", // v4.3.2
        "symfony/console": "4.3.*", // v4.3.2
        "symfony/dotenv": "4.3.*", // v4.3.2
        "symfony/expression-language": "4.3.*", // v4.3.2
        "symfony/flex": "^1.1", // v1.21.6
        "symfony/framework-bundle": "4.3.*", // v4.3.2
        "symfony/http-client": "4.3.*", // v4.3.3
        "symfony/monolog-bundle": "^3.4", // v3.4.0
        "symfony/security-bundle": "4.3.*", // v4.3.2
        "symfony/twig-bundle": "4.3.*", // v4.3.2
        "symfony/validator": "4.3.*", // v4.3.2
        "symfony/webpack-encore-bundle": "^1.6", // v1.6.2
        "symfony/yaml": "4.3.*" // v4.3.2
    },
    "require-dev": {
        "hautelook/alice-bundle": "^2.5", // 2.7.3
        "symfony/browser-kit": "4.3.*", // v4.3.3
        "symfony/css-selector": "4.3.*", // v4.3.3
        "symfony/maker-bundle": "^1.11", // v1.12.0
        "symfony/phpunit-bridge": "^4.3", // v4.3.3
        "symfony/stopwatch": "4.3.*", // v4.3.2
        "symfony/web-profiler-bundle": "4.3.*" // v4.3.2
    }
}

Previous Chapter

Next Chapter