…some users the superpower to temporarily log in as someone else. Here's how. First, we need to enable the feature. In security.yaml, under our firewall somewhere, add switch_user: true: This activates a new authenticator. So we now have our CustomAuthenticator, form_login…

…can configure this. Remember: to get this config, I ran debug:config security... which shows your current configuration, including defaults. But not all options are shown here. To see a full list, run config:dump security. Instead of showing your actual config, this shows a…

…delete that entirely. There are two ways that you can "force" the remember me system to always set a cookie even though the checkbox isn't there. The first is in security.yaml: set always_remember_me: to true: Yes, I totally just misspelled remember..…

…or a year... or whatever we configure. Let's add this. The first step is to go to config/packages/security.yaml and activate the system. We do this by saying remember_me: and then, below, setting one required piece of config: secret: set to…

…2nd argument to CustomCredentials. For us, that's the submitted password: Let's pretend that all users have the same password tada! To validate that, return true if $credentials === 'tada': Air-tight security! If we return true from this function, authentication is successful! Woo…

…log out link. Access was granted for all three of these. In addition to IS_AUTHENTICATED_FULLY, there are a couple of other special strings that you can pass into the security system. The first is IS_AUTHENTICATED_REMEMBERED, which is super powerful... but can…

…Yup, we have ROLE_USER. This is too boring... so let's add some true admin users! First, open config/packages/security.yaml... and, down under access_control, change this to once again require ROLE_ADMIN: Remember: roles are just strings that we invent... they…

…get our first look at authorization. That's the fun part where we get to run around and deny access to different parts of our site. The easiest way to kick someone out of your party is actually right inside of config/packages/security.yaml…

…At the start of every request, before Symfony calls the controller, the security system executes a set of "authenticators". The job of each authenticator is to look at the request, see if there is any authentication information that it understands - like a submitted email and…

…since we want to really learn security, let's do this step-by-step... mostly by hand. Before we start thinking about authenticating the user, we first need to build a login page, which... if you think about it... has nothing to do with security…

…what's actually stored on this field is a "hash" or kind of "fingerprint" of the plaintext password and there are multiple hashing algorithms available. The one you're using is configured in config/packages/security.yaml: The encoders section says that whenever we encode…

…the routing layer happens! That's RouterListener. You can also see Firewall: this is where authentication takes place. Security is a complex system... so being able to see a bit about what happens inside of it is pretty cool. At some point... it calls a…

…uploaded article images? The first question to ask is: can these uploaded files be public to everyone? Or do we need to do some sort of security check before a user can view or download them? For article images, they can be public. But we…

…through PHP. If your server is configured to execute any file ending in .php through PHP, that is a huge security risk. Ok, back to butterflies and ice cream. Even after we add validation to guarantee that the uploaded file is actually an image, the…

… Inside SecurityBundle, look at DependencyInjection and open SecurityExtension.php. This class loads several XML files that provide all of the services for this bundle. Inside the Resources/config/ directory, open security.xml. Around line 136... yep! You'll see the services that our new service…

…more level of difficulty: it's time to contribute new code with a pull request. Let's look at an issue I found: #27835. This comes from the Security component. Let me give you some background: if you try to access a protected page as…

…supported in version 4.0. You should rename or alias security.user_password_encoder.generic to ... long class name... UserPasswordEncoder instead. Um... what????? This is saying that somewhere, we are type-hinting an argument with Symfony\Component\Security\Core\Encoder\UserPasswordEncoder... but there is no…

…login page... which has just a little bit of its own JavaScript: a toggleable message and an error if you get crazy and type a super-long username. Open up the template: app/Resources/FOSUserBundle/views/Security/login.html.twig. Yep, it has a script…

…use the micro instance size, and just use the default settings on the next screens. For the security group, I'm going to select a group I already created: "Web Access Testing." The important thing is to allow port 22 for SSH and ports 80…

…I just make something up, like journey and put a dino_count of 10 under it: When we refresh, we get a huge error! And it says it found valid namespaces for framework, security, twig, monolog, blah blah blah. Hey, those are the root keys…