Chapters

47 Chapters | 4:41:51 |

01

composer require security

5:07
02

make:user

5:57
03

Customizing the User Class

3:08
04

Building a Login Form

3:07
05

Firewalls & Authenticators

6:39
06

Authenticator & The Passport

6:24
07

Custom User Query & Credentials

6:04
08

Authentication Success & Refreshing the User

6:33
09

When Authentication Fails

7:19
10

Customize Error Messages & Adding Logout

7:33
11

Giving Users Passwords

5:26
12

Hashing Plain Passwords & PasswordCredentials

4:22
13

Security Listener System & Csrf Protection

6:40
14

Remember Me System

7:07
15

Always Remember Me & "signature_properties"

6:28
16

Denying Access, access_control & Roles

5:22
17

The Entry Point: Inviting Users to Log In

6:45
18

AbstractLoginFormAuthenticator & Redirecting to Previous URL

5:13
19

form_login: The Built-in Authenticator

5:42
20

More form_login Config

3:25
21

Denying Access in a Controller

4:57
22

Dynamic Roles

4:28
23

The Special IS_AUTHENTICATED_ Strings

9:18
24

Fetching the User Object

6:38
25

Custom User Methods & the User in a Service

7:21
26

Role Hierarchy

5:37
27

Impersonation: switch_user

5:27
28

User API & the Serializer

5:37
29

To use API Token Authentication or Not?

4:09
30

Registration Form

5:25
31

Manual Authentication

6:12
32

Making Questions owned by Users

5:13
33

Leveraging the Question Owner

6:09
34

Voters

6:27
35

Custom Voter

6:52
36

Verify Email after Registration

7:57
37

Verifying the Signed Confirm Email URL

7:18
38

Login Throttling & Events

6:11
39

Security Events & Listeners

4:00
40

Creating a Security Event Subscriber

8:47
41

Custom Redirect when "Email Not Verified"

7:16
42

2 Factor Authentication & Authentication Tokens

8:33
43

2fa with TOTP (Time-Based One Time Password)

5:20
44

Activating 2FA

5:34
45

Rendering the QR Code

6:13
46

QR Data & Scanning with an Authenticator App

4:35
47

Customize The 2-Factor Auth Form

5:53

> Symfony 5 > Symfony 5 Security: Authenticators

Buy Access to Course

33.

Leveraging the Question Owner

|

|

Autoplay

Keep on Learning!

If you liked what you've learned so far, dive in! Subscribe to get
access to this tutorial plus video, code and script downloads.

Start your All-Access Pass

Buy just this tutorial for $12.00

Previous Chapter

Next Chapter

With a Subscription, click any sentence in the script to jump to that part of the video!

Login Subscribe

Login or register to check out the script

2 Comments

Sort By

Login or Register to join the conversation

gazzatav 3 years ago edited

Gary Taverner • 6 minutes ago
Hi
At the end of this chapter I found the behaviour when I try to edit a question different from the video. If I'm not authenticated I go to the symfony local server's EOF page (traffic lights, red stripe on blue background # EOF). Searching for 'EOF' in symfony docs gets exactly 0 matches for EOF (which surprised me, and no, 'effective' is not what I was searching for).

Unauthenticated - my question -> # EOF
Authenticated - my question -> app_question_edit
Unauthenticated - not my question -> # EOF
Authenticated - not my question -> 403 Access Denied

The redirection to the login page works if I go to /api/me while unauthenticated.

In the logs I can see that three authenticators are tried and then I'm referred to the entry point which is form_login:

<blockquote>[Application] Aug 6 15:51:17 |DEBUG | SECURI Checking for authenticator support. authenticators=3 firewall_name="main"
[Application] Aug 6 15:51:17 |DEBUG | SECURI Checking support on authenticator. authenticator="App\Security\DummyAuthenticator"
[Application] Aug 6 15:51:17 |DEBUG | SECURI Authenticator does not support the request.
[Application] Aug 6 15:51:17 |DEBUG | SECURI Checking support on authenticator. authenticator="Symfony\Component\Security\Http\Authenticator\FormLoginAuthenticator"
[Application] Aug 6 15:51:17 |DEBUG | SECURI Authenticator does not support the request.
[Application] Aug 6 15:51:17 |DEBUG | SECURI Checking support on authenticator. authenticator="Symfony\Component\Security\Http\Authenticator\RememberMeAuthenticator"
[Application] Aug 6 15:51:17 |DEBUG | SECURI Authenticator does not support the request.
[Application] Aug 6 15:51:17 |DEBUG | DOCTRI SELECT t0.id AS id_1, t0.title AS title_2, t0.slug AS slug_3, t0.question AS question_4, t0.asked_at AS asked_at_5, t0.votes AS votes_6, t0.created_at AS created_at_7, t0.updated_at AS updated_at_8, t0.owner_id AS owner_id_9 FROM question t0 WHERE t0.slug = ? LIMIT 1 0="et-sunt-ut-numquam-sit"
[Application] Aug 6 15:51:17 |DEBUG | SECURI Access denied, the user is not fully authenticated; redirecting to authentication entry point.
[Application] Aug 6 15:51:17 |DEBUG | SECURI Calling Authentication entry point.
[Web Server ] Aug 6 15:51:18 |ERROR | SERVER GET (502) /questions/edit/et-sunt-ut-numquam-sit ip="::1"
</blockquote>

Under form_login in security.yaml I have:


login_path: app_login
check_path: app_login
username_parameter: email
password_parameter: password
csrf_parameter: _csrf_token
csrf_token_id: authenticate
enable_csrf: true

My form_login leads to app_login so I'm mystified as to why this fails. In the address bar I can see the path /questions/edit/et-sunt-ut-numquam-sit. The end of the query looks odd though 't0.slug = ? LIMIT 1 0="et-sunt-ut-numquam-sit"'.

Any ideas?

|

weaverryan SFCASTS gazzatav 3 years ago edited

Hey @gazzatav!

Ah, I know that "EOF" page that you're talking about, and it's super frustrating. When this happens, basically, something inside your app/PHP is exploding in a horrible way. This is... almost the web server's "segfault": something went so wrong that it can't even show it. Often you just need to stop the server and restart it. But it's also very possible that there is some sort of bug/bad behavior in the code... but unfortunately, it's so "bad" (e.g. infinite recursion) that it can't be shown.. which makes it pretty tough to debug.

Looking at the situation above, it seems like the "common thread" is that if you go to ANY question (your question or another question) while not authenticated, you get the EOF. We need to figure out why. I would temporarily, GREATLY reduce the code on the question page - heck even put a "return new Response('foo')" in that controller to see if you can get it to load. Assuming that works, slowly re-add code to your page until you trigger that EOF. Hopefully that'll help you dig down into the problem. If there's a better way to debug the EOF, I'm not aware of it. Also, if you don't have XDebug installed, try that: that can help handle things like infinite recursion better.

Let me know what you find out :).

Cheers!

|

This tutorial also works great for Symfony 6!

symfony 5.3

What PHP libraries does this tutorial use?

// composer.json
{
    "require": {
        "php": ">=8.2",
        "ext-ctype": "*",
        "ext-iconv": "*",
        "babdev/pagerfanta-bundle": "^3.3", // v3.3.0
        "composer/package-versions-deprecated": "^1.11", // 1.11.99.4
        "doctrine/annotations": "^1.0", // 1.13.2
        "doctrine/doctrine-bundle": "^2.1", // 2.6.3
        "doctrine/doctrine-migrations-bundle": "^3.0", // 3.1.1
        "doctrine/orm": "^2.7", // 2.10.1
        "knplabs/knp-markdown-bundle": "^1.8", // 1.9.0
        "knplabs/knp-time-bundle": "^1.11", // v1.16.1
        "pagerfanta/doctrine-orm-adapter": "^3.3", // v3.3.0
        "pagerfanta/twig": "^3.3", // v3.3.0
        "phpdocumentor/reflection-docblock": "^5.2", // 5.2.2
        "scheb/2fa-bundle": "^5.12", // v5.12.1
        "scheb/2fa-qr-code": "^5.12", // v5.12.1
        "scheb/2fa-totp": "^5.12", // v5.12.1
        "sensio/framework-extra-bundle": "^6.0", // v6.2.0
        "stof/doctrine-extensions-bundle": "^1.4", // v1.6.0
        "symfony/asset": "5.3.*", // v5.3.4
        "symfony/console": "5.3.*", // v5.3.7
        "symfony/dotenv": "5.3.*", // v5.3.8
        "symfony/flex": "^1.3.1", // v1.21.6
        "symfony/form": "5.3.*", // v5.3.8
        "symfony/framework-bundle": "5.3.*", // v5.3.8
        "symfony/monolog-bundle": "^3.0", // v3.7.0
        "symfony/property-access": "5.3.*", // v5.3.8
        "symfony/property-info": "5.3.*", // v5.3.8
        "symfony/rate-limiter": "5.3.*", // v5.3.4
        "symfony/runtime": "5.3.*", // v5.3.4
        "symfony/security-bundle": "5.3.*", // v5.3.8
        "symfony/serializer": "5.3.*", // v5.3.8
        "symfony/stopwatch": "5.3.*", // v5.3.4
        "symfony/twig-bundle": "5.3.*", // v5.3.4
        "symfony/ux-chartjs": "^1.3", // v1.3.0
        "symfony/validator": "5.3.*", // v5.3.8
        "symfony/webpack-encore-bundle": "^1.7", // v1.12.0
        "symfony/yaml": "5.3.*", // v5.3.6
        "symfonycasts/verify-email-bundle": "^1.5", // v1.5.0
        "twig/extra-bundle": "^2.12|^3.0", // v3.3.3
        "twig/string-extra": "^3.3", // v3.3.3
        "twig/twig": "^2.12|^3.0" // v3.3.3
    },
    "require-dev": {
        "doctrine/doctrine-fixtures-bundle": "^3.3", // 3.4.0
        "symfony/debug-bundle": "5.3.*", // v5.3.4
        "symfony/maker-bundle": "^1.15", // v1.34.0
        "symfony/var-dumper": "5.3.*", // v5.3.8
        "symfony/web-profiler-bundle": "5.3.*", // v5.3.8
        "zenstruck/foundry": "^1.1" // v1.13.3
    }
}

Previous Chapter

Next Chapter