Challenge 1 / 2

Before 8.2, we added a fake ROLE_DISABLED in getRoles() whenever a user was disabled. Nothing ever checked for that role, so why did it log disabled users out?

The access_control rules require users to have only the roles listed in role_hierarchy

Our user checker ran on every request and saw the new role

Symfony automatically denies access to any user with a role starting with ROLE_DISABLED

On each request, Symfony compares the user in the session to a fresh copy from the database, and different roles count as a changed user

Rewatch the video