…user or updating their password. Then we will hash it. That's something we're going to solve in a future tutorial when we talk more about security. But this will be good enough for now. Oh, and above username, also add user:read and…

…email & password, head to config/packages/security.yaml. Under the firewall, add json_login and below that check_path... which should be set to the name of the route that we just created. So, app_login: This activates a security listener: it's a bit…

…AJAX call is working great. Though, there is one gotcha with the json_login security mechanism: it requires you to send a Content-Type header set to application/json. We are setting this on our Ajax call and you should to: But... if someone forgets…

…because we're dealing with payment stuff. You can also configure 2FA at a later time for even more security. Remember to use your real email because you'll need to confirm it before you can begin. We'll also send some test emails that…

…Shazam! We're green! So let's go set that value for real. This is easy enough: add a private Security argument... and make sure you first arg has a comma. Then this is true if $this->security->getUser() equals $treasure->getOwner(). And... then... the…

…to throw an exception from inside the method. We've created this entirely because we need a route: Symfony's security system will intercept things before the controller is called: To activate that magic, in security.yaml, add a key called logout with path below…

…item, that central object is that single item. And that's really important. It's used in various places, like the security attribute: when we use is_granted, the object variable will be that "central" object. For example, if we make a Patch() request, that…

…to access the UI as it shows sensitive information. We don't have security configured in this app, so I'll just remove this line: src/Entity/ProcessedMessage.php is a new entity added by the recipe. This is also a stub that extends this…

…but not normal users. Add treasure:write. That means anyone with access to the Patch operation can write to this field... which in reality, thanks to the security on that operation... and a custom voter we created... is just admin users and the owner. Try…

…on a Mac. Run: open bin/tailwindcss If this is the first time you've downloaded the file, it will ask you to verify that you do want to open it from a security standpoint. Okay! We now have the bin/tailwindcss executable, which does…

…ApiPlatform/, let's also delete AdminGroupsContextBuilder. This was a complex way to make fields readable or writable by our admin... but we're going to solve that with ApiProperty security. Also get rid of the custom normalizer... which added a field and an extra group…

…we want to add the owner:read group. On the constructor, autowire the Security service as a property: Then, down here, if $object is an instanceof DragonTreasure - because this method will be called for all of our API resource classes - and $this->security->getUser() equals…

…The user sends the plain-text password they want... then we're saving that directly into the database. That's a huge security problem... and it makes it impossible to log in as this user, because Symfony expects the password property to hold a hashed…

…a faster way to log in. Instead of making the POST request, say ->actingAs($user): This is a sneaky way of taking the User object and pushing it directly into Symfony's security system without making any requests. It's easier, and faster. And now…

…have access. That sounds like a pain in the butt! Fortunately, Symfony has a feature just for this called role hierarchy. Open up config/packages/security.yaml and, anywhere inside of here... but I'll put it near the top, add role_hierarchy. Below this…

…message: {user} is voting on answer {answer} Pass this a second argument, which is called the logger "context". This is unrelated to security... it's just kind of cool. The second argument is an array of any extra data that you want to store along…

…https://app.lemonsqueezy.com/js/lemon.js. Also add the defer attribute. LemonSqueezy advises against self-hosting the lemon.js file, since you might miss out on new features and crucial security patches. Be sure to link it directly, to keep payment-related matters as…

…But that won't work, as we're not authorized to send emails on behalf of that user. More on email security soon. Fortunately, there's a special email header called Reply-To for just this scenario. When building your email, set it with ->replyTo…

…chain of decorated services. Ok, let's get to work setting the owner. Autowire our favorite Security service so we can figure out who is logged in: Then, before we do the saving, if $data is an instanceof DragonTreasure and $data->getOwner() is null and…

…to the data that they are not allowed to make - like they could set a field to foo but they aren't allowed to change it to bar because they don't have enough permissions. How should we handle that? It's security meets validation.