Challenge #1 of 1

Imagine I have the following link in Twig:

{% if is_granted('IS_AUTHENTICATED_REMEMBERED') %}
    <a href="{{ path('app_change_password') }}">Change Password</a>
{% endif %}

And this code in the controller:

/**
 * @Route("/change/password", name="app_change_password")
 */
public function changePassword()
{
    $this->denyAccessUnlessGranted('IS_AUTHENTICATED_FULLY');
}

Does this code make sense?

This code does not make sense. You should change the Twig code to check for IS_AUTHENTICATED_FULLY to match the controller. Otherwise, if a user that is only authenticated thanks to their "remember me" cookie clicks the link, they will get an access denied screen!

This code does technically make sense... as long as the system is not using a "remember me" cookie system.

This code does make sense. If a user that is only authenticated thanks to their "remember me" cookie clicks the link, Symfony redirect them to the login page.

Rewatch Video

TRACK

Symfony 5 >

COURSE

Symfony 5 Security: Authenticators >

CHAPTER

The Special IS_AUTHENTICATED_ Strings

Challenge #1 of 1