…variable is literally going to be an AuthenticationException object. And remember, to figure out what went wrong, all AuthenticationException objects have a getMessageKey() method that returns an explanation. In templates/security/login.html.twig, let's render that. Right after the h1, say if error…

…this to dynamically create the query string. Technically, this is simple. But wait! What I’m about to show you is a huge security hole, I mean huge! Take the $limit variable and add it to the end of the string. This is called concatenation: …

…return the exact same data we already have? Yes! We do this not because we need to, but for security. If we read the request JSON directly, it's possible that the request is coming from some external, mean-spirited person instead of from Stripe…

…id, redirect_uri and scope parameters. But we get an error: It's complaining about the redirect URL we're sending. For added security, OAuth servers allow, and sometimes require you to configure your redirect URL in your application. Go back to our application and…

…https://app.lemonsqueezy.com/js/lemon.js. Also add the defer attribute. LemonSqueezy advises against self-hosting the lemon.js file, since you might miss out on new features and crucial security patches. Be sure to link it directly, to keep payment-related matters as…

…because we're dealing with payment stuff. You can also configure 2FA at a later time for even more security. Remember to use your real email because you'll need to confirm it before you can begin. We'll also send some test emails that…

…to the next pattern, let's take a look at a real-world example. Symfony leverages Chain of Responsibility in its security component. It uses a concept called "Voters" to determine if a user has access to a specific resource or not. But Symfony implements…

…ApiPlatform/, let's also delete AdminGroupsContextBuilder. This was a complex way to make fields readable or writable by our admin... but we're going to solve that with ApiProperty security. Also get rid of the custom normalizer... which added a field and an extra group…

…I'll say CHANGEME. You can't see me type that... only because Symfony hides it for security reasons. Since this is the first secret we've created, Symfony automatically created the secrets vault behind the scenes... which is literally a set of files that…

…we're going to need the current user object, which we get via the security service. Let's autowire that: add public function __construct() - with a Security $security argument. Hit "alt" + "enter" and go "Initialize properties" to create that property and set it. Love it…

…able to see and edit other user accounts. We could hide the section entirely for moderators, or we could add some security so that only their own user account is visible to them. This is called "entity permissions". It answers the question of whether or…

…out all the way - I don't want to dive into the form system - but we are going to get it started. And this is going to lead us to a really interesting security situation. Over in src/Controller/QuestionController.php... find the show() action…

…have access. That sounds like a pain in the butt! Fortunately, Symfony has a feature just for this called role hierarchy. Open up config/packages/security.yaml and, anywhere inside of here... but I'll put it near the top, add role_hierarchy. Below this…

…message: {user} is voting on answer {answer} Pass this a second argument, which is called the logger "context". This is unrelated to security... it's just kind of cool. The second argument is an array of any extra data that you want to store along…

…they're basically doing the same thing that we are. So let's use this instead of our custom authenticator... which I would do in a real project unless I need the flexibility of a custom authenticator. In security.yaml, comment-out our customer authenticator..…

…see that it's super simple: it just reads a very specific key from the session. This is the key that the security system sets when an anonymous user tries to access a protected page. Let's try this thing! We're already logged out…

…once it's uploaded, we'll need a way to link to that file... except if you need to do a security check before letting the user download the file. Then you'll need to handle things in a totally different way. Um... so wow…

…exchanging an authorization code for a token, and using the token; Authentication (single sign-on) using OAuth; Handling expired tokens; Using refresh tokens; Integrating and authentication with Facebook; OAuth integration with Google+; What to look out for with security and how you can tighten things.

…hear: SPF, DKIM and DMARC. Here's the 60 second explanation of the first two. Both SFP and DKIM are security mechanisms where you can set specific DNS records that will say exactly who is allowed to send emails from your domain. SPF works by…

…Guzzle. Let's do this! Make a request with $client->request(): make a POST request to /api/cheeses. How nice is that? We're going to focus our tests mostly on asserting security stuff. Because we haven't logged in, this request will not be…