This course is still being released! Check back later for more chapters.

Get Notified About this Course!

We will send you messages regarding this course only
and nothing else, we promise.
You can unsubscribe anytime by emailing us at:
privacy@symfonycasts.com
> Symfony >

Course Overview

Symfony 8.2 Security Upgrades

Upgrade to Symfony 8.2 and put its new security features to work - from one-line logout forms to CSRF-proof impersonation and a real sudo mode.

  • intermediate
  • 54 students
  • EN/ES Captions
  • EN/ES Script
  • Certificate of Completion

Your Guides

About this course

What PHP libraries does this tutorial use? 

// composer.json
{
    "require": {
        "php": ">=8.4",
        "ext-ctype": "*",
        "ext-iconv": "*",
        "babdev/pagerfanta-bundle": "^4.6", // v4.8.0
        "doctrine/dbal": "^4.4", // 4.5.0
        "doctrine/doctrine-bundle": "^3.2", // 3.3.4
        "doctrine/doctrine-migrations-bundle": "^3.7", // 3.7.0
        "doctrine/orm": "^3.6", // 3.7.5
        "knplabs/knp-time-bundle": "^2.5", // 2.5.0
        "pagerfanta/doctrine-orm-adapter": "^4.8", // v4.11.0
        "php-cs-fixer/shim": "^3.94", // v3.95.27
        "phpdocumentor/reflection-docblock": "^5.6", // 5.6.7
        "phpstan/phpdoc-parser": "^2.3", // 2.4.0
        "stof/doctrine-extensions-bundle": "^1.15", // v1.15.3
        "symfony/asset": "8.2.*", // 8.2.x-dev
        "symfony/asset-mapper": "8.2.*", // 8.2.x-dev
        "symfony/console": "8.2.*", // 8.2.x-dev
        "symfony/dotenv": "8.2.*", // 8.2.x-dev
        "symfony/expression-language": "8.2.*", // 8.2.x-dev
        "symfony/flex": "^2.10", // v2.12.0
        "symfony/form": "8.2.*", // 8.2.x-dev
        "symfony/framework-bundle": "8.2.*", // 8.2.x-dev
        "symfony/http-client": "8.2.*", // 8.2.x-dev
        "symfony/mailer": "8.2.*", // 8.2.x-dev
        "symfony/monolog-bundle": "^4.0", // v4.1.0
        "symfony/property-access": "8.2.*", // 8.2.x-dev
        "symfony/property-info": "8.2.*", // 8.2.x-dev
        "symfony/rate-limiter": "8.2.*", // 8.2.x-dev
        "symfony/runtime": "8.2.*", // 8.2.x-dev
        "symfony/security-bundle": "8.2.*", // 8.2.x-dev
        "symfony/security-csrf": "8.2.*", // 8.2.x-dev
        "symfony/serializer": "8.2.*", // 8.2.x-dev
        "symfony/stimulus-bundle": "^3.0", // v3.6.0
        "symfony/twig-bundle": "8.2.*", // 8.2.x-dev
        "symfony/ux-turbo": "^3.0", // v3.6.0
        "symfony/validator": "8.2.*", // 8.2.x-dev
        "symfony/yaml": "8.2.*", // 8.2.x-dev
        "symfonycasts/reset-password-bundle": "^1.25", // v1.26.1
        "symfonycasts/tailwind-bundle": "^0.12.0", // v0.12.0
        "twig/extra-bundle": "^3.24", // v3.29.0
        "twig/twig": "^3.24" // v3.30.0
    },
    "require-dev": {
        "symfony/debug-bundle": "8.2.*", // 8.2.x-dev
        "symfony/maker-bundle": "^1.67", // 1.68.0
        "symfony/stopwatch": "8.2.*", // 8.2.x-dev
        "symfony/web-profiler-bundle": "8.2.*", // 8.2.x-dev
        "zenstruck/foundry": "^2.9" // v2.15.0
    }
}

Symfony 8.2 adds security features that replace code you've likely written by hand. We'll take the app from Symfony Security: The Basics and Going Further, upgrade it to 8.2, and swap our workarounds for the new built-in tools.

We'll simplify logout, lock down impersonation, log disabled users out the right way, build a real sudo mode that asks for a recent login before risky actions, and define a one-off rate limiter right where it's used.

What You'll Learn

  • Upgrading to Symfony 8.2
  • The logout_button() helper
  • CSRF-protected impersonation with impersonation_button()
  • Logging out disabled users with user_checker_on_refresh
  • Sudo mode with IS_AUTHENTICATED_RECENTLY and IS_AUTHENTICATED_VERY_RECENTLY
  • Confirm-password pages for re-authentication
  • One-off rate limiters with RateLimiterBuilder

Next courses in the Symfony: Learn More Tricks section of the Symfony Track!

Bonjour-> Hello-> Hola: Translate your Site

Bonjour-> Hello-> Hola: Translate your Site

11 Videos | 45:05 | 0%
Dependency Injection #[Attributes]

Dependency Injection #[Attributes]

11 Videos | 45:42 | 0%
Lemon Squeezy Payment Processor

Lemon Squeezy Payment Processor

19 Videos | 1:49:02 | 0%

Comments

Sort By
Login or Register to join the conversation

Delete the comment?

Share this comment

astronaut with balloons in space

"Houston: no signs of life"
Start the conversation!