…this isTotpAuthenticationEnabled() method returned true. Second, the security "token" - that internal thing that wraps your User object when you log in - well, it matches one of the tokens in our configuration. Specifically, we get the UsernamePasswordToken when we log in via the form_login mechanism…

…and hit tab to get the use statement on top: For the most part, I've been using IS_AUTHENTICATED_REMEMBERED for security... so that you just need to be logged in... even if it’s via a "remember me" cookie. But I'm using…

…after the user enables two-factor authentication, let's render a template with an image to this URL. Return $this->render('security/enable2fa.html.twig'). Copy the template name, head into templates/security, and create that: enable2fa.html.twig. I'll paste in a basic…

…Step 4 is to configure the firewall. This part we do need to do. Start by copying the two_factor stuff. Then open up config/packages/security.yaml. This new config can live anywhere under our main firewall. I'll paste it after form_login…

…and we're implementing PasswordAuthenticatedUserInterface, I'm going to remove this comment above the method: Ok, let's forget about security for a minute. Instead, focus on the fact that we need to be able to store a unique password for each user in the…

…security.yaml. Anywhere under our firewall, add logout: true: Internally, this activates a "listener" that looks for any requests to /logout. And actually, instead of just saying logout: true, you can customize how this works. Find your terminal and run: symfony console debug:config security…

…variable is literally going to be an AuthenticationException object. And remember, to figure out what went wrong, all AuthenticationException objects have a getMessageKey() method that returns an explanation. In templates/security/login.html.twig, let's render that. Right after the h1, say if error…

…have an object that is instantiated on every request... but only needs to do real work in rare cases. Certain event subscribers - like our AgreeToTermsSubscriber - Symfony security voters & Twig extensions are other examples from Symfony. These services might be quick to instantiate... so no problem…

…keep going! Because the article {id} is in the URL, add an Article $article argument. Oh, and we need security! You can only upload a file if you have access to edit this article. In our app, we check that with this @IsGranted("MANAGE", subject=…

…API, we would want to have a different endpoint for making a GET request to /admin/article/references/{id} that would return the JSON for that one reference. Inside, add the ArticleReference $reference argument and then we'll add our normal security check. In fact…

…references. Now add the methods="GET" - yes you can leave off the curly braces when there's just one method - and name="admin_article_list_references". Down in the method, add the Article argument and don't forget the security check: @IsGranted("MANAGE", subject="article")…

…the file directly: it's not public. Instead, we're going to link to a Symfony route and controller and that controller will check security and return the file to the user. Let's do this in ArticleReferenceAdminController. Add a new public function, how about…

…things into the public/ directory: they will be publicly accessible. We'll talk about private uploads soon - those are files where you need to do some security checks before you allow a user to see them. Change the directory to %kernel.project_dir% and then…

…exchanging an authorization code for a token, and using the token; Authentication (single sign-on) using OAuth; Handling expired tokens; Using refresh tokens; Integrating and authentication with Facebook; OAuth integration with Google+; What to look out for with security and how you can tighten things.

…if there is one, and if there is, call setIsMe(true) on it. Add public function __construct() with a Security $security argument. I'll hit Alt+Enter and go to "Initialize properties" to create that property and set it: Then down in onRequestEvent(), start with:…

…user via the SearchFilter on CheeseListing. And using subresources means that you have more endpoints to keep track of, and, when we get to security, more endpoints means more access control to think about. So, use subresources if you want, but I don't recommend…

…the request headers, request content - which is really important when you're sending JSON - and all the goodies that you expect - cache, performance, security, Doctrine, etc. In addition to the little web debug toolbar AJAX tracker we just saw, there are a few other ways…

…what each does, the parameters of the input, what output to expect, details related to security... it basically tries to completely describe your API. So if you have one of these JSON configuration files, you can plug it into Swagger UI and... boom! You get…

…also JSON-LD or HAL JSON. Then there's hypermedia, linked data, status codes, error formats, documentation - including API spec documentation that can power Swagger. Then there's security, CORS, access control and other important features like pagination, filtering, validation, content-type negotiation, GraphQL... and..…

…talks to the database! First, we need to finish our entities. Find Security and copy the id field. Open Dinosaur and paste this in. Do the same for Enclosure. We haven't needed these yet because we haven't touched the database at all. Now…