Symfony Security: Going Further

You've got login working, users have roles, and your app is protected. Nice! Now let's dig into some of the extra tools and techniques that can make your Symfony security system more flexible, polished and secure.

In this course, we'll build on the fundamentals from Symfony Security: The Basics and tackle the kinds of security problems that show up in real applications.

Here's what we'll cover:

• Creating a super-admin voter that can override other permissions
• Adding "sudo mode" to require a fresh, full authentication for sensitive actions
• Customizing authentication error messages
• Redirecting users after login with _target_path
• Returning a 404 instead of a 403 with #[IsGranted]
• Letting users log in with either their username or email address
• Creating a custom voter to control who can impersonate whom
• Rejecting compromised passwords with NotCompromisedPassword
• Building logout forms with the new logout_form() helper
• Hardening user impersonation with Symfony 8.2
• Rate limiting registration with #[RateLimit]

Along the way, we'll see how to customize Symfony Security without fighting the framework, and how a few small changes can make authentication and authorization safer and nicer for your users.

Let's level up our security!