…I'll say CHANGEME. You can't see me type that... only because Symfony hides it for security reasons. Since this is the first secret we've created, Symfony automatically created the secrets vault behind the scenes... which is literally a set of files that…

…file for the frontend. This means that users that visit our frontend are downloading snarkdown_controller and snarkdown itself. That's probably not a security problem... but it is wasteful and will slow down the frontend experience. My favorite way to fix this is to…

…out all the way - I don't want to dive into the form system - but we are going to get it started. And this is going to lead us to a really interesting security situation. Over in src/Controller/QuestionController.php... find the show() action…

…really easy. We could just autowire the LoginFormAuthenticator service up here and pass it in. But, in our security.yaml file, our main way of authenticating is form_login: That does activate an authenticator service behind the scenes - just like our custom LoginFormAuthenticator. The tricky…

…this to dynamically create the query string. Technically, this is simple. But wait! What I’m about to show you is a huge security hole, I mean huge! Take the $limit variable and add it to the end of the string. This is called concatenation: …

…to the next pattern, let's take a look at a real-world example. Symfony leverages Chain of Responsibility in its security component. It uses a concept called "Voters" to determine if a user has access to a specific resource or not. But Symfony implements…

…but then this would override that. Watch: if we try the tests: They pass because the field is gone. For our mission, we can leverage a super cool option called security. Set it to is_granted("ROLE_ADMIN"): That's it! If this expression return…

… Well, at first, it's relatively easy because we have total control via the security expression. So we can add something like if is_granted("ROLE_ADMIN") OR and then put parentheses around the other use-case: Let's make sure it works! A 500…

…in the database. I love that. This is all possible thanks to a powerful event listener system inside of security. Let's learn more about that next and see how we can leverage it to add CSRF protection to our login form... with about two…

…it in action. To start, we need to create a custom authentication exception class. This will serve as the "signal" that we're in this "account not verified" situation. In the Security/ directory, add a new class: how about AccountNotVerifiedAuthenticationException. Make it extend AuthenticationException. And…

…they're basically doing the same thing that we are. So let's use this instead of our custom authenticator... which I would do in a real project unless I need the flexibility of a custom authenticator. In security.yaml, comment-out our customer authenticator..…

…see that it's super simple: it just reads a very specific key from the session. This is the key that the security system sets when an anonymous user tries to access a protected page. Let's try this thing! We're already logged out…

…none of our authenticators provide an entry point... so let's add one! Open up our authenticator: src/Security/LoginFormAuthenticator.php. If you want your authenticator to provide an entry point, all you need to do is implement a new interface: AuthenticationEntryPointInterface: This requires the…

…once it's uploaded, we'll need a way to link to that file... except if you need to do a security check before letting the user download the file. Then you'll need to handle things in a totally different way. Um... so wow…

…that shows you exactly how long each part of your application took to render. This is amazing for debugging and profiling. There's also details in here on Twig, security, routes and other cool stuff. We'll keep exploring this as we go along. Ok…

…id, redirect_uri and scope parameters. But we get an error: It's complaining about the redirect URL we're sending. For added security, OAuth servers allow, and sometimes require you to configure your redirect URL in your application. Go back to our application and…

…endpoint. Notice I'm giving the new user a blank password. Does that mean someone could login as the user by entering a blank password? That would be a huge security hole! The problem is that the user isn't choosing a password. In fact…

…Depending on your preference, you will probably either use the popular FOSUserBundle or implement this yourself by following our How to load Security Users from the Database cookbook entry. In either case, creating a system with “groups” and “permissions” is very possible, where a user…

…we're going to need the current user object, which we get via the security service. Let's autowire that: add public function __construct() - with a Security $security argument. Hit "alt" + "enter" and go "Initialize properties" to create that property and set it. Love it…

…able to see and edit other user accounts. We could hide the section entirely for moderators, or we could add some security so that only their own user account is visible to them. This is called "entity permissions". It answers the question of whether or…