…Shazam! We're green! So let's go set that value for real. This is easy enough: add a private Security argument... and make sure you first arg has a comma. Then this is true if $this->security->getUser() equals $treasure->getOwner(). And... then... the…

…on a Mac. Run: open bin/tailwindcss If this is the first time you've downloaded the file, it will ask you to verify that you do want to open it from a security standpoint. Okay! We now have the bin/tailwindcss executable, which does…

…we want to add the owner:read group. On the constructor, autowire the Security service as a property: Then, down here, if $object is an instanceof DragonTreasure - because this method will be called for all of our API resource classes - and $this->security->getUser() equals…

…chain of decorated services. Ok, let's get to work setting the owner. Autowire our favorite Security service so we can figure out who is logged in: Then, before we do the saving, if $data is an instanceof DragonTreasure and $data->getOwner() is null and…

…But that won't work, as we're not authorized to send emails on behalf of that user. More on email security soon. Fortunately, there's a special email header called Reply-To for just this scenario. When building your email, set it with ->replyTo…

…but not normal users. Add treasure:write. That means anyone with access to the Patch operation can write to this field... which in reality, thanks to the security on that operation... and a custom voter we created... is just admin users and the owner. Try…

…item, that central object is that single item. And that's really important. It's used in various places, like the security attribute: when we use is_granted, the object variable will be that "central" object. For example, if we make a Patch() request, that…

…Step 4 is to configure the firewall. This part we do need to do. Start by copying the two_factor stuff. Then open up config/packages/security.yaml. This new config can live anywhere under our main firewall. I'll paste it after form_login…

…security.yaml. Anywhere under our firewall, add logout: true: Internally, this activates a "listener" that looks for any requests to /logout. And actually, instead of just saying logout: true, you can customize how this works. Find your terminal and run: symfony console debug:config security…

…Depending on your preference, you will probably either use the popular FOSUserBundle or implement this yourself by following our How to load Security Users from the Database cookbook entry. In either case, creating a system with “groups” and “permissions” is very possible, where a user…

…inspire people to be the best chefs they can be... for their dogs. This is a pretty traditional Symfony app with a few controllers and some Twig templates. It also has two entities: A User entity for security, and a Recipe entity. On the site…

…file for the frontend. This means that users that visit our frontend are downloading snarkdown_controller and snarkdown itself. That's probably not a security problem... but it is wasteful and will slow down the frontend experience. My favorite way to fix this is to…

…this isTotpAuthenticationEnabled() method returned true. Second, the security "token" - that internal thing that wraps your User object when you log in - well, it matches one of the tokens in our configuration. Specifically, we get the UsernamePasswordToken when we log in via the form_login mechanism…

…and hit tab to get the use statement on top: For the most part, I've been using IS_AUTHENTICATED_REMEMBERED for security... so that you just need to be logged in... even if it’s via a "remember me" cookie. But I'm using…

…really easy. We could just autowire the LoginFormAuthenticator service up here and pass it in. But, in our security.yaml file, our main way of authenticating is form_login: That does activate an authenticator service behind the scenes - just like our custom LoginFormAuthenticator. The tricky…

…in the database. I love that. This is all possible thanks to a powerful event listener system inside of security. Let's learn more about that next and see how we can leverage it to add CSRF protection to our login form... with about two…

…after the user enables two-factor authentication, let's render a template with an image to this URL. Return $this->render('security/enable2fa.html.twig'). Copy the template name, head into templates/security, and create that: enable2fa.html.twig. I'll paste in a basic…

…it in action. To start, we need to create a custom authentication exception class. This will serve as the "signal" that we're in this "account not verified" situation. In the Security/ directory, add a new class: how about AccountNotVerifiedAuthenticationException. Make it extend AuthenticationException. And…

…none of our authenticators provide an entry point... so let's add one! Open up our authenticator: src/Security/LoginFormAuthenticator.php. If you want your authenticator to provide an entry point, all you need to do is implement a new interface: AuthenticationEntryPointInterface: This requires the…

…and we're implementing PasswordAuthenticatedUserInterface, I'm going to remove this comment above the method: Ok, let's forget about security for a minute. Instead, focus on the fact that we need to be able to store a unique password for each user in the…