Chapters

47 Chapters | 4:41:51 |

01

composer require security

5:07
02

make:user

5:57
03

Customizing the User Class

3:08
04

Building a Login Form

3:07
05

Firewalls & Authenticators

6:39
06

Authenticator & The Passport

6:24
07

Custom User Query & Credentials

6:04
08

Authentication Success & Refreshing the User

6:33
09

When Authentication Fails

7:19
10

Customize Error Messages & Adding Logout

7:33
11

Giving Users Passwords

5:26
12

Hashing Plain Passwords & PasswordCredentials

4:22
13

Security Listener System & Csrf Protection

6:40
14

Remember Me System

7:07
15

Always Remember Me & "signature_properties"

6:28
16

Denying Access, access_control & Roles

5:22
17

The Entry Point: Inviting Users to Log In

6:45
18

AbstractLoginFormAuthenticator & Redirecting to Previous URL

5:13
19

form_login: The Built-in Authenticator

5:42
20

More form_login Config

3:25
21

Denying Access in a Controller

4:57
22

Dynamic Roles

4:28
23

The Special IS_AUTHENTICATED_ Strings

9:18
24

Fetching the User Object

6:38
25

Custom User Methods & the User in a Service

7:21
26

Role Hierarchy

5:37
27

Impersonation: switch_user

5:27
28

User API & the Serializer

5:37
29

To use API Token Authentication or Not?

4:09
30

Registration Form

5:25
31

Manual Authentication

6:12
32

Making Questions owned by Users

5:13
33

Leveraging the Question Owner

6:09
34

Voters

6:27
35

Custom Voter

6:52
36

Verify Email after Registration

7:57
37

Verifying the Signed Confirm Email URL

7:18
38

Login Throttling & Events

6:11
39

Security Events & Listeners

4:00
40

Creating a Security Event Subscriber

8:47
41

Custom Redirect when "Email Not Verified"

7:16
42

2 Factor Authentication & Authentication Tokens

8:33
43

2fa with TOTP (Time-Based One Time Password)

5:20
44

Activating 2FA

5:34
45

Rendering the QR Code

6:13
46

QR Data & Scanning with an Authenticator App

4:35
47

Customize The 2-Factor Auth Form

5:53

> Symfony 5 > Symfony 5 Security: Authenticators

Buy Access to Course

13.

Security Listener System & Csrf Protection

|

|

Autoplay

Keep on Learning!

If you liked what you've learned so far, dive in! Subscribe to get
access to this tutorial plus video, code and script downloads.

Start your All-Access Pass

Buy just this tutorial for $12.00

Previous Challenge

Next Chapter

With a Subscription, click any sentence in the script to jump to that part of the video!

Login Subscribe

Login or register to check out the script

9 Comments

Sort By

Login or Register to join the conversation

Mahmut-A 1 year ago edited

Hi,

I want to ask that you are configuring plainpassword in UseFactory as hard coded. However if I do in AppFixtures as below,

UserFactory::createOne(['email' =>'mahmut.aydin@netsys.com.tr']);
UserFactory::createOne(['plainPassword' =>'test123']);

do you suggest this? I want to push User's data from one file.( AppFixtures)

|

sadikoff Mahmut-A 1 year ago edited

If I correctly understood your question you can just load your file in fixtures and process it like you want, for example read all users with passwords and create them with factory

Cheers!

|

Mahmut-A sadikoff 1 year ago

Hi sadikoff,

I fixed as below: thank you.

` UserFactory::createOne([

        'userName' => 'Mahmut Aydin',
        'email' => 'mahmut.aydin@netsys.com.tr',
        'plainPassword' => 'test123'
    ]);

    UserFactory::createOne([
        'userName' => 'Baris Telli',
        'email' => 'baris.telli@netsys.com.tr',
        'plainPassword' => 'test123'
    ]);

    UserFactory::createOne([
        'userName' => 'Ömer İlk',
        'email' => 'omer.ilk@netsys.com.tr',
        'plainPassword' => 'test123'
    ]);`

|

Peter-K 1 year ago edited

Ryan I have very strange one.

I am using symfony forms everywhere and also security is based on your tutorials and documentation for my 5.4, 6.4 projects.

Now, in my new project I am not using symfony forms so I have to implement CSRF protection and here is my question, where I am failing but it seems that it is also issue here and everywhere in my other projects where I am using symfony forms with csrf tokens.

I wanted to test my solution for CSRF implementation if it is working and then I started to question why is it not working like I am expecting so I tested other projects if I am able to replicate it there and it is exactly the same issue so I have this login form and went to developer tools and added "1" in front of _csrf_token value.

I submitted form and it is letting me. Token is valid BUT when I add more characters or change completely _csrf_token value, it will output CSRF Token is Invalid.

I thought it must be perfect match, not just partial or how does it work?

You can try it too. Just clone this code go to developer tools update _csrf_token field value by adding ONE random letter in front of current value

Submit form... it will NOT print CSRF token is invalid but let you progress but if you change completely _csrf_token field value to "Hi,thisisRyan" it will output invalid token so whats the point of implementing CSRF if there does not have to be EXACT match?

|

weaverryan SFCASTS Peter-K 1 year ago edited

Hey @Peter-K!

What an interesting find! I don't know the answer, but:

1) I don't see an attack vector here, even if it is true

2) Though I don't see a "smoking gun", it's possible that the (de)randomization (https://github.com/symfony/symfony/blob/7.3/src/Symfony/Component/Security/Csrf/CsrfTokenManager.php#L118) or splitting on . (https://github.com/symfony/symfony/blob/7.3/src/Symfony/Component/Security/Csrf/CsrfTokenManager.php#L120) could allow for this.

If you dig in further and learn more, I'd love to know!

|

Naglaa-Fouz 3 years ago

i am working in project reast api and i don't kow how to implement csrf beccause i have not the parte frondend so what i can do kow?thanks

|

weaverryan SFCASTS Naglaa-Fouz 3 years ago

Hi there!

Sorry for the slow reply! Do your frontend and API live on the same domain name? Or different domain names? Are you using session-based authentication or something different?

Cheers!

|

Mepcuk 4 years ago

How CSRF protection work in Symfony? How app know what CSRF token was send to form and after that validate it ?

|

weaverryan SFCASTS Mepcuk 3 years ago

Hey!

Somehow we completely missed your comment! Bah - sorry!

The answer is that, when generating a CSRF token, Symfony stores that value in the session. Then, when the user submits the CSRF token, we check that it matches what was in the session. This isn't the only want to do CSRF tokens, but it's the most standard and the one Symfony uses by default.

Cheers!

|

This tutorial also works great for Symfony 6!

symfony 5.3

What PHP libraries does this tutorial use?

// composer.json
{
    "require": {
        "php": ">=8.2",
        "ext-ctype": "*",
        "ext-iconv": "*",
        "babdev/pagerfanta-bundle": "^3.3", // v3.3.0
        "composer/package-versions-deprecated": "^1.11", // 1.11.99.4
        "doctrine/annotations": "^1.0", // 1.13.2
        "doctrine/doctrine-bundle": "^2.1", // 2.6.3
        "doctrine/doctrine-migrations-bundle": "^3.0", // 3.1.1
        "doctrine/orm": "^2.7", // 2.10.1
        "knplabs/knp-markdown-bundle": "^1.8", // 1.9.0
        "knplabs/knp-time-bundle": "^1.11", // v1.16.1
        "pagerfanta/doctrine-orm-adapter": "^3.3", // v3.3.0
        "pagerfanta/twig": "^3.3", // v3.3.0
        "phpdocumentor/reflection-docblock": "^5.2", // 5.2.2
        "scheb/2fa-bundle": "^5.12", // v5.12.1
        "scheb/2fa-qr-code": "^5.12", // v5.12.1
        "scheb/2fa-totp": "^5.12", // v5.12.1
        "sensio/framework-extra-bundle": "^6.0", // v6.2.0
        "stof/doctrine-extensions-bundle": "^1.4", // v1.6.0
        "symfony/asset": "5.3.*", // v5.3.4
        "symfony/console": "5.3.*", // v5.3.7
        "symfony/dotenv": "5.3.*", // v5.3.8
        "symfony/flex": "^1.3.1", // v1.21.6
        "symfony/form": "5.3.*", // v5.3.8
        "symfony/framework-bundle": "5.3.*", // v5.3.8
        "symfony/monolog-bundle": "^3.0", // v3.7.0
        "symfony/property-access": "5.3.*", // v5.3.8
        "symfony/property-info": "5.3.*", // v5.3.8
        "symfony/rate-limiter": "5.3.*", // v5.3.4
        "symfony/runtime": "5.3.*", // v5.3.4
        "symfony/security-bundle": "5.3.*", // v5.3.8
        "symfony/serializer": "5.3.*", // v5.3.8
        "symfony/stopwatch": "5.3.*", // v5.3.4
        "symfony/twig-bundle": "5.3.*", // v5.3.4
        "symfony/ux-chartjs": "^1.3", // v1.3.0
        "symfony/validator": "5.3.*", // v5.3.8
        "symfony/webpack-encore-bundle": "^1.7", // v1.12.0
        "symfony/yaml": "5.3.*", // v5.3.6
        "symfonycasts/verify-email-bundle": "^1.5", // v1.5.0
        "twig/extra-bundle": "^2.12|^3.0", // v3.3.3
        "twig/string-extra": "^3.3", // v3.3.3
        "twig/twig": "^2.12|^3.0" // v3.3.3
    },
    "require-dev": {
        "doctrine/doctrine-fixtures-bundle": "^3.3", // 3.4.0
        "symfony/debug-bundle": "5.3.*", // v5.3.4
        "symfony/maker-bundle": "^1.15", // v1.34.0
        "symfony/var-dumper": "5.3.*", // v5.3.8
        "symfony/web-profiler-bundle": "5.3.*", // v5.3.8
        "zenstruck/foundry": "^1.1" // v1.13.3
    }
}

Previous Challenge

Next Chapter