…Shazam! We're green! So let's go set that value for real. This is easy enough: add a private Security argument... and make sure you first arg has a comma. Then this is true if $this->security->getUser() equals $treasure->getOwner(). And... then... the…

…item, that central object is that single item. And that's really important. It's used in various places, like the security attribute: when we use is_granted, the object variable will be that "central" object. For example, if we make a Patch() request, that…

…I'll say CHANGEME. You can't see me type that... only because Symfony hides it for security reasons. Since this is the first secret we've created, Symfony automatically created the secrets vault behind the scenes... which is literally a set of files that…

…ones, like ResponseListener. Let's open that one up. I'll hit Shift+Shift to open ResponseListener.php: get the one from http-kernel/, not security. It says: ResponseListener fixes the Response headers based on the Request. Let's... find out what that means. Inside…

…I keep responsible version constraints in composer.json, ahem, no dev-master or * versions, this is pretty safe and also means I get bug fixes, security fixes and new features. And... hello Symfony 3.4! The best part? Ah, you guys already know it: thanks…

…overriding the first... so let's remove the extra one. Anyways, for our first test, I want to make sure this security is working. Add public function testCreateCheeseListing(). And inside, make sure this all isn't an elaborate dream with $this->assertEquals(42, 42). Ok…

…Guzzle. Let's do this! Make a request with $client->request(): make a POST request to /api/cheeses. How nice is that? We're going to focus our tests mostly on asserting security stuff. Because we haven't logged in, this request will not be…

…cheat for now. Find your terminal and run: php bin/console security:encode This is a fun utility where you can give it a plain-text password - I'll use foo - and it will give us back an encoded version of that password. Copy that…

…the request headers, request content - which is really important when you're sending JSON - and all the goodies that you expect - cache, performance, security, Doctrine, etc. In addition to the little web debug toolbar AJAX tracker we just saw, there are a few other ways…

…and things like this. In these tools are also available the security. So when you think about an API, you don't really think about security and you don't have to care about it because we did all the work. We prepared this for…

…So, one afternoon, in an office somewhere, uh, we were having a security scan, um, and certain requests were hanging on certain conditions. Um, and basically it boiled down to the fact that the text protocol of Memcached cannot really handle new lines in the…

…and... refresh! Bah: require is not defined Boo! My bad - I forgot to use the new built file. Open templates/bundles/FOSUserBundle/Security/login.html.twig. Point the script tag to build/login.js: And now... it works! When I type a really long username…

…ApiPlatform/, let's also delete AdminGroupsContextBuilder. This was a complex way to make fields readable or writable by our admin... but we're going to solve that with ApiProperty security. Also get rid of the custom normalizer... which added a field and an extra group…

…new Passport(). By the way, if you're new to the custom authenticator system and want to learn more, check out our Symfony 5 Security tutorial where we talk all about this. I'll go through the basics now, but the details live there. Before…

…the list says: SessionInterface aliases are deprecated, use $requestStack->getSession() instead. It's being referenced by the LoginFormAuthenticator service. Let's go check that out! Open src/Security/LoginFormAuthenticator.php. Ahh. I'm autowiring the SessionInterface service. In Symfony 6, that service no longer exists…

…this isTotpAuthenticationEnabled() method returned true. Second, the security "token" - that internal thing that wraps your User object when you log in - well, it matches one of the tokens in our configuration. Specifically, we get the UsernamePasswordToken when we log in via the form_login mechanism…

…and hit tab to get the use statement on top: For the most part, I've been using IS_AUTHENTICATED_REMEMBERED for security... so that you just need to be logged in... even if it’s via a "remember me" cookie. But I'm using…

…after the user enables two-factor authentication, let's render a template with an image to this URL. Return $this->render('security/enable2fa.html.twig'). Copy the template name, head into templates/security, and create that: enable2fa.html.twig. I'll paste in a basic…

…Step 4 is to configure the firewall. This part we do need to do. Start by copying the two_factor stuff. Then open up config/packages/security.yaml. This new config can live anywhere under our main firewall. I'll paste it after form_login…

…over $initialDinosaurs as $dinosaurs and say, this->addDinosaur($dinosaur). That was the mistake that other programmer made: I'm using addDinosaur() instead of just setting the $dinosaurs property directly because that method contains the security checks. So... that should be it! Let's try phpspec…