…secrets management Auto-validation The new PHP 7.4 "preload" file Using "migrate_from" to migrate your hashed passwords for max security bin/console lint:container And these are just my favorite features (see Symfony.com 4.4/5.0 Features Blog for even more…

…you'll learn how to: Install & setup FOSUserBundle Understanding and configuring security Using your own base layout Overriding templates Customizing and extending the forms Removing the username field entirely Updating any text via translations Creating an event subscriber to do things before/after registration (or…

…we're attacking the hard stuff: Using a serializer Token Authentication System (Silex's security system) Hypermedia versus media The HAL hypermedia type The HATEOAS PHP library The HAL Browser Embedding resources (versus adding links) Tricks with Behat for testing API's Pagination and filtering…

…bundle, and with good reason. It comes packed with features for login, registration, forgot password and a lot more. But it's also a big tool, and learning to master it will go a long way to making the security system in your application great.

…I'll start running symfony console, which is the same thing. Thanks to the new bundle, we have a ton of commands that start with make! Commands for generating a security system, making a controller, generating doctrine entities to talk to the database, forms, listeners…

…double-check our user was added correctly, run: symfony console dbal:run-sql 'select * from user' Nice, here he is! But hmm... we have a serious security issue here... don't worry, we'll fix it soon... but can you guess what it is? Next…

…accepts a $key parameter, which is the firewall key defined in config/packages/security.yaml under the firewalls section. Passing a key allows generating logout links for different firewalls. There's another common method to check if a user is logged in. Our users have…

…roles. So add ROLE_CAPTAIN as a child: Now refresh the /parts page... Nice! We have access! If you open the security profiler panel you can see, yep, her roles are ROLE_ADMIN and ROLE_USER. But there's a new section below: "Inherited Roles"…

…s a maker for that! Over in your terminal, run: symfony console make:voter Call it StarshipVoter. Now go take a look at what that created: src/Security/Voter/StarshipVoter.php. It added some boilerplate for us, including two permission constants. For the first one…

…request, doesn't mean other sites can't trigger it. To completely prevent this, we need to implement CSRF protection for it. Open config/packages/security.yaml. Under the main firewall section, find the logout key. Add enable_csrf: true: Let's try it out…

…tweak this cookie to your liking. To see the options, run the following in your terminal: symfony console config:dump framework session Remember, the session isn't security-specific, that's why it's configured at the framework level. Here, you can see that we…

…just like isGranted(), is another helper that comes from AbstractController. It throws the correct exception, which will be caught by Symfony's security system and handled appropriately. Hope over to the app in your browser and refresh the /parts page. Huh. We're redirected to…

…without that role cannot switch users. Finally, target_route is where you want to send the user after the switch occurs. Time to configure this. First, go to config/packages/security.yaml. Down in role_hierarchy, under ROLE_ADMIN, add ROLE_ALLOWED_TO_SWITCH: Now…

…You may need to access the current user in another service. And that service won't have access to the AbstractController helper methods. In our index() method, inject Security, the one from the SecurityBundle, $security: This is a helper service that can access the currently…

…to access the UI as it shows sensitive information. We don't have security configured in this app, so I'll just remove this line: src/Entity/ProcessedMessage.php is a new entity added by the recipe. This is also a stub that extends this…

…user or updating their password. Then we will hash it. That's something we're going to solve in a future tutorial when we talk more about security. But this will be good enough for now. Oh, and above username, also add user:read and…

…you want to, instead of using the IsGranted PHP attribute, you could also say $this->denyAccessUnlessGranted(). And you could also go to config/packages/security.yaml and, down at the bottom, add an access_control that protects the entire /admin section: Actually, adding this access…

…because we're dealing with payment stuff. You can also configure 2FA at a later time for even more security. Remember to use your real email because you'll need to confirm it before you can begin. We'll also send some test emails that…

…able to see and edit other user accounts. We could hide the section entirely for moderators, or we could add some security so that only their own user account is visible to them. This is called "entity permissions". It answers the question of whether or…

…this to dynamically create the query string. Technically, this is simple. But wait! What I’m about to show you is a huge security hole, I mean huge! Take the $limit variable and add it to the end of the string. This is called concatenation: …