Challenge 1 / 2

Our controller takes the user as a non-nullable argument:

public function __invoke(
    #[CurrentUser]
    User $user,
    // ...
): Response {

We never added an #[IsGranted] or an access_control rule - yet visiting /change-password while logged out sends us straight to the login page. Why?

Symfony passes null, and the redirect comes from the firewall noticing that $user->setPassword() failed.

With nobody logged in, Symfony has no User to hand a non-nullable argument, so it denies access - and the firewall turns that into a redirect to the login form.

Routes whose templates live under security/ are covered by an access_control rule out of the box.

#[CurrentUser] implies IS_AUTHENTICATED_FULLY and runs an access check of its own before the controller is called.

Rewatch the video