Challenge 1 / 1

Imagine I have the following link in Twig:

{% if is_granted('IS_AUTHENTICATED_REMEMBERED') %}
    <a href="{{ path('app_change_password') }}">Change Password</a>
{% endif %}

And this code in the controller:

/**
 * @Route("/change/password", name="app_change_password")
 */
public function changePassword()
{
    $this->denyAccessUnlessGranted('IS_AUTHENTICATED_FULLY');
}

Does this code make sense?

This code does not make sense. You should change the Twig code to check for IS_AUTHENTICATED_FULLY to match the controller. Otherwise, if a user that is only authenticated thanks to their "remember me" cookie clicks the link, they will get an access denied screen!

This code does technically make sense... as long as the system is not using a "remember me" cookie system.

This code does make sense. If a user that is only authenticated thanks to their "remember me" cookie clicks the link, Symfony redirect them to the login page.

Rewatch the video