Chapters

13 Chapters | 1:13:41 |

01

Returning a 404 Instead of 403 with IsGranted

4:00
02

Disabling Users with a Custom UserChecker

5:41
03

Forcing Logout on Disabled Users

3:31
04

Customizing Authentication Error Messages

6:00
05

Sudo Mode: Requiring Full Authentication

5:00
06

Creating a Super Admin Voter

5:23
07

Redirecting After Login with _target_path

4:28
08

Logging in with a Username or Email

5:21
09

Restricting Impersonation with a Voter

6:40
10

Resetting a Forgotten Password

10:49
11

Adding a Change Password Form & UserPassword

7:14
12

Requiring Strong, Uncompromised Passwords

4:06
13

Rate Limiting the Registration Form

5:28

> Symfony > Symfony Security: Going Further

Buy Access to Course Buy Access

05.

Sudo Mode: Requiring Full Authentication

|

|

Autoplay

Keep on Learning!

If you liked what you've learned so far, dive in! Subscribe to get
access to this tutorial plus video, code and script downloads.

Start your All-Access Pass

Previous Challenge

Next Challenge

With a Subscription, click any sentence in the script to jump to that part of the video!

Login Subscribe

Login or Register to check out the script

3 Comments

Sort By

Login or Register to join the conversation

JeffJones 5 days ago edited

It seems to me that setting the remember me field to 1, is a security problem. If someone logged in and selected to not remember me because they were in a shady internet cafe and then went to an admin page, they'd be automatically logged in with remember me set.

Is there some way to set the value to the current remember me setting in the session?

|

kbond SFCASTS JeffJones 5 days ago edited

Hey @JeffJones!

Good catch! In this course's setup it can't actually happen. The confirm form only shows when you're logged in but not fully authenticated, and that only happens through a remember-me cookie, so you already opted in. If you logged in at the internet cafe without checking "Remember me", you're fully authenticated and never see this form.

That changes with Symfony 8.2's new sudo mode features. With IS_AUTHENTICATED_RECENTLY, a fully authenticated user whose login is a few hours old also gets sent back to this form, and the hidden 1 would quietly turn a "don't remember me" login into a remembered one. We'll cover those features in the upcoming Symfony 8.2 Security course, and I'll fix this there.

You don't need to store anything in the session for the fix, because the remember-me cookie already records that choice. Check for it directly:

{% if is_granted('IS_REMEMBERED') %}
    <input type="hidden" name="_remember_me" value="1">
{% else %}
    {# the normal checkbox #}
{% endif %}

IS_REMEMBERED is only true when you were authenticated by the remember-me cookie, so you're only "re-remembered" if you already opted in.

--Kevin

|

JeffJones kbond 5 days ago

Thanks for the clear explanation - and the fix. Apparently I hadn't thought out the details. It just seemed dangerous to preset the remember me option.

|

While this tutorial's code uses Symfony 8, everything discussed works in Symfony 7!

Symfony 8 PHP 8.4

What PHP libraries does this tutorial use?

// composer.json
{
    "require": {
        "php": ">=8.4",
        "ext-ctype": "*",
        "ext-iconv": "*",
        "babdev/pagerfanta-bundle": "^4.6", // v4.6.0
        "doctrine/dbal": "^4.4", // 4.4.3
        "doctrine/doctrine-bundle": "^3.2", // 3.2.2
        "doctrine/doctrine-migrations-bundle": "^3.7", // 3.7.0
        "doctrine/orm": "^3.6", // 3.6.6
        "knplabs/knp-time-bundle": "^2.5", // 2.5.0
        "pagerfanta/doctrine-orm-adapter": "^4.8", // v4.8.0
        "php-cs-fixer/shim": "^3.94", // v3.95.2
        "phpdocumentor/reflection-docblock": "^5.6", // 5.6.7
        "phpstan/phpdoc-parser": "^2.3", // 2.3.2
        "stof/doctrine-extensions-bundle": "^1.15", // v1.15.3
        "symfony/asset": "8.0.*", // v8.0.8
        "symfony/asset-mapper": "8.0.*", // v8.0.11
        "symfony/console": "8.0.*", // v8.0.11
        "symfony/dotenv": "8.0.*", // v8.0.11
        "symfony/expression-language": "8.0.*", // v8.0.14
        "symfony/flex": "^2.10", // v2.10.0
        "symfony/form": "8.0.*", // v8.0.9
        "symfony/framework-bundle": "8.0.*", // v8.0.11
        "symfony/http-client": "8.0.*", // v8.0.9
        "symfony/mailer": "8.0.*", // v8.0.15
        "symfony/monolog-bundle": "^4.0", // v4.0.2
        "symfony/property-access": "8.0.*", // v8.0.8
        "symfony/property-info": "8.0.*", // v8.0.8
        "symfony/rate-limiter": "8.0.*", // v8.0.14
        "symfony/runtime": "8.0.*", // v8.0.12
        "symfony/security-bundle": "8.0.*", // v8.0.12
        "symfony/security-csrf": "8.0.*", // v8.0.8
        "symfony/serializer": "8.0.*", // v8.0.10
        "symfony/stimulus-bundle": "^2.34", // v2.35.0
        "symfony/twig-bundle": "8.0.*", // v8.0.8
        "symfony/ux-turbo": "^2.34", // v2.35.0
        "symfony/validator": "8.0.*", // v8.0.10
        "symfony/yaml": "8.0.*", // v8.0.12
        "symfonycasts/reset-password-bundle": "^1.25", // v1.25.0
        "symfonycasts/tailwind-bundle": "^0.12.0", // v0.12.0
        "twig/extra-bundle": "^3.24", // v3.24.0
        "twig/twig": "^3.24" // v3.26.0
    },
    "require-dev": {
        "symfony/debug-bundle": "8.0.*", // v8.0.8
        "symfony/maker-bundle": "^1.67", // v1.67.0
        "symfony/stopwatch": "8.0.*", // v8.0.8
        "symfony/web-profiler-bundle": "8.0.*", // v8.0.12
        "zenstruck/foundry": "^2.9" // v2.10.1
    }
}

Previous Challenge

Next Challenge