Challenge 1 / 2

We add ROLE_DISABLED to getRoles() when a user is disabled. Nothing in the app ever checks for that role - so why does adding it log them out?

Adding a role invalidates the signature on the session cookie.

On every request Symfony reloads the user and compares them to the copy in the session - roles are part of that comparison, so any change deauthenticates the token.

The user checker runs on every request and sees the new role.

ROLE_DISABLED is a reserved role that the firewall rejects automatically.

Rewatch the video