…But that won't work, as we're not authorized to send emails on behalf of that user. More on email security soon. Fortunately, there's a special email header called Reply-To for just this scenario. When building your email, set it with ->replyTo…

…we want to add the owner:read group. On the constructor, autowire the Security service as a property: Then, down here, if $object is an instanceof DragonTreasure - because this method will be called for all of our API resource classes - and $this->security->getUser() equals…

…to the data that they are not allowed to make - like they could set a field to foo but they aren't allowed to change it to bar because they don't have enough permissions. How should we handle that? It's security meets validation.

… Well, at first, it's relatively easy because we have total control via the security expression. So we can add something like if is_granted("ROLE_ADMIN") OR and then put parentheses around the other use-case: Let's make sure it works! A 500…

…to throw an exception from inside the method. We've created this entirely because we need a route: Symfony's security system will intercept things before the controller is called: To activate that magic, in security.yaml, add a key called logout with path below…

…AJAX call is working great. Though, there is one gotcha with the json_login security mechanism: it requires you to send a Content-Type header set to application/json. We are setting this on our Ajax call and you should to: But... if someone forgets…

…email & password, head to config/packages/security.yaml. Under the firewall, add json_login and below that check_path... which should be set to the name of the route that we just created. So, app_login: This activates a security listener: it's a bit…

…how the end-user will get that token. So let's talk about that first use-case: the user of your API is your own JavaScript. Well, before we even dive into security, make sure your frontend and your API live on the same domain..…

…file for the frontend. This means that users that visit our frontend are downloading snarkdown_controller and snarkdown itself. That's probably not a security problem... but it is wasteful and will slow down the frontend experience. My favorite way to fix this is to…

…chain of decorated services. Ok, let's get to work setting the owner. Autowire our favorite Security service so we can figure out who is logged in: Then, before we do the saving, if $data is an instanceof DragonTreasure and $data->getOwner() is null and…

…but then this would override that. Watch: if we try the tests: They pass because the field is gone. For our mission, we can leverage a super cool option called security. Set it to is_granted("ROLE_ADMIN"): That's it! If this expression return…

…we're going to need the current user object, which we get via the security service. Let's autowire that: add public function __construct() - with a Security $security argument. Hit "alt" + "enter" and go "Initialize properties" to create that property and set it. Love it…

…The user sends the plain-text password they want... then we're saving that directly into the database. That's a huge security problem... and it makes it impossible to log in as this user, because Symfony expects the password property to hold a hashed…

…a faster way to log in. Instead of making the POST request, say ->actingAs($user): This is a sneaky way of taking the User object and pushing it directly into Symfony's security system without making any requests. It's easier, and faster. And now…

…what each does, the parameters of the input, what output to expect, details related to security... it basically tries to completely describe your API. So if you have one of these JSON configuration files, you can plug it into Swagger UI and... boom! You get…

…also JSON-LD or HAL JSON. Then there's hypermedia, linked data, status codes, error formats, documentation - including API spec documentation that can power Swagger. Then there's security, CORS, access control and other important features like pagination, filtering, validation, content-type negotiation, GraphQL... and..…

…nothing! Just, "Welcome to Dinosaur Park". Instead of creating a park full of dinosaurs and then worrying about security... ahem... we don't have any code yet. We're going to build this dino factory and write tests all at the same time. The de…

…Depending on your preference, you will probably either use the popular FOSUserBundle or implement this yourself by following our How to load Security Users from the Database cookbook entry. In either case, creating a system with “groups” and “permissions” is very possible, where a user…

…https://app.lemonsqueezy.com/js/lemon.js. Also add the defer attribute. LemonSqueezy advises against self-hosting the lemon.js file, since you might miss out on new features and crucial security patches. Be sure to link it directly, to keep payment-related matters as…

…but not normal users. Add treasure:write. That means anyone with access to the Patch operation can write to this field... which in reality, thanks to the security on that operation... and a custom voter we created... is just admin users and the owner. Try…