…and, with any lucky, some security systems that - thanks to our tests - won't fail as soon as a storm rolls in or a developer leaves early for lunch. To make sure our dinosaurs don't once again rule the Earth, you should totally code…

…enabled as the Security CSRF component is not installed. Ohhhh. Like translation and form, csrf_protection activates a component that we don't have installed! No problem! Go back to symfony.sh and search for "csrf". There it is! Run: composer require security-csrf By…

…good. What else do we have? Check out the "Fence Security Activated" message on the site. Let's imagine we need to create an API where someone can make an API request to turn the fence security on or off from anywhere. For example, if…

…user) %} - passing the user from the current loop as the subject. Add {% endif %}... and indent the guts: The other thing: our SuperAdminVoter in src/Security/Voter/ has that EXCLUSIONS list. Add CAN_IMPERSONATE to that list, so super admins can't bypass our new voter.…

…fixtures, so over in the terminal, reload them with: symfony console foundry:load-fixtures Now create our custom voter: symfony console make:voter Call it SuperAdminVoter. Jump back to the IDE and find it: src/Security/Voter/SuperAdminVoter.php. Clear everything out - the constants, supports…

…In src/Form/RegistrationFormType.php, after email, add username: Then the login template, templates/security/login.html.twig. Change the description to mention the username, change the label to "Email or Username", and change the input type to text so we're not forcing someone…

…Create a new class in our src/ directory. Call it UserChecker, and the namespace will be App\Security, so it lives in a Security sub-namespace. Make it final and add implements UserCheckerInterface. This interface has two methods you need to implement. There's checkPreAuth()…

…which will be a string. Eventually, in the security tutorial, we'll change this to be a relationship to a User entity. Use the 255 length and make it not nullable. Oh, and one more: a votes property that's an integer so that people…

…yes! Every record has isMe: true. Setting this to the correct value is probably the easiest part of the whole process. Start by adding a second argument to the constructor - Security $security - so we can get the authenticated user. I'll hit Alt+Enter and…

…if there is one, and if there is, call setIsMe(true) on it. Add public function __construct() with a Security $security argument. I'll hit Alt+Enter and go to "Initialize properties" to create that property and set it: Then down in onRequestEvent(), start with:…

…status code instead of allowing this: To fix that, we need to see if the user is an admin. Add a second argument to the constructor Security $security. I'll initialize this property: Then below, update the if statement: if the description is too short…

…I'll just create one... and log in is that user so that we have access to the PUT request: Thanks to the last tutorial, we already have security rules to prevent anyone from editing someone else's listing. Down here, for the JSON body…

…hear: SPF, DKIM and DMARC. Here's the 60 second explanation of the first two. Both SFP and DKIM are security mechanisms where you can set specific DNS records that will say exactly who is allowed to send emails from your domain. SPF works by…

…we need to make this userIsOwner() method... actually work! Add a constructor to the top of this class and autowire the Security service. I'll hit Alt -> Enter and go to "Initialize Fields" to create that property and set it. Down in the method…

…when a user is updating their password. We talk about that on an older Symfony 3 Security Tutorial. We're going to try a different approach - an approach that's more specific to API Platform. Before we get there, let's write a test to…

…let's add this to the API for all users by adding @Groups("user:write"). This creates a huge security hole... so we'll come back to this in a few minutes and make sure that only admin users can write to this field. Let…

…bin/console make:voter Call it CheeseListingVoter. I commonly have one voter for each entity or "resource" that has complex access rules. This creates src/Security/Voter/CheeseListingVoter.php. Before we dive into the new class, go to CheeseListing. Instead of saying is_granted('ROLE…

…user via the SearchFilter on CheeseListing. And using subresources means that you have more endpoints to keep track of, and, when we get to security, more endpoints means more access control to think about. So, use subresources if you want, but I don't recommend…

…engage. Perfect! We still have access but... well... anyone has access to this page right now. The simplest way to enforce our custom security logic is to add it right in the controller. Check it out: if ($article->getAuthor() !== $this->getUser()) and if !$this…

…that same, big, adorable empty authenticator we saw earlier. To tell Symfony to use this, open config/packages/security.yaml and add the new class under authenticators: If you're using that newer, fancier version of this command, it already did this for you. Lucky…