…cheat for now. Find your terminal and run: php bin/console security:encode This is a fun utility where you can give it a plain-text password - I'll use foo - and it will give us back an encoded version of that password. Copy that…

…user via the SearchFilter on CheeseListing. And using subresources means that you have more endpoints to keep track of, and, when we get to security, more endpoints means more access control to think about. So, use subresources if you want, but I don't recommend…

…the request headers, request content - which is really important when you're sending JSON - and all the goodies that you expect - cache, performance, security, Doctrine, etc. In addition to the little web debug toolbar AJAX tracker we just saw, there are a few other ways…

…what each does, the parameters of the input, what output to expect, details related to security... it basically tries to completely describe your API. So if you have one of these JSON configuration files, you can plug it into Swagger UI and... boom! You get…

…also JSON-LD or HAL JSON. Then there's hypermedia, linked data, status codes, error formats, documentation - including API spec documentation that can power Swagger. Then there's security, CORS, access control and other important features like pagination, filtering, validation, content-type negotiation, GraphQL... and..…

…have a normal entity class that also has a getUsername() method and a getRoles() method. It's really, pretty boring. The other file that was modified was config/packages/security.yaml. Go back to your terminal and run: git diff to see what changed. Ah…

…Shift+Shift and search for this: AppVariable. Cool! Ignore the setter methods on top - these are just for setup. The AppVariable has a couple of handy methods: getToken() and getUser() both relate to security. Then, hey! There's our favorite getRequest() method, then getSession(), getEnvironment(…

…into your browser! Ah, that's a little security check that prevents any non-local users from accessing our dev environment. Just for now, go into the web/ directory, open app_dev.php, and comment-out the two security lines: Refresh again! Hey, it's…

…is never, ever sent to our servers... which is the greatest news I have ever heard from a security standpoint. I do not want to handle your CC number: this would greatly increase the security requirements on my server. Instead, when you hit "Pay", this…

…client, but we absolutely don’t want to expose any of our internals. Make sure whatever logic you use here is very solid. #security Even our logic is a bit loose. For example, if we go to a URL that just doesn’t exist, the…

…them without the client's credentials, as you'll see. Having two keys instead of one is a method often used in security to make it harder for attackers to compromise a system. Fortunately, COOP does support refresh tokens. Open up the CoopOAuthController where we…

…endpoint. Notice I'm giving the new user a blank password. Does that mean someone could login as the user by entering a blank password? That would be a huge security hole! The problem is that the user isn't choosing a password. In fact…

…the list says: SessionInterface aliases are deprecated, use $requestStack->getSession() instead. It's being referenced by the LoginFormAuthenticator service. Let's go check that out! Open src/Security/LoginFormAuthenticator.php. Ahh. I'm autowiring the SessionInterface service. In Symfony 6, that service no longer exists…

…ones, like ResponseListener. Let's open that one up. I'll hit Shift+Shift to open ResponseListener.php: get the one from http-kernel/, not security. It says: ResponseListener fixes the Response headers based on the Request. Let's... find out what that means. Inside…

…things into the public/ directory: they will be publicly accessible. We'll talk about private uploads soon - those are files where you need to do some security checks before you allow a user to see them. Change the directory to %kernel.project_dir% and then…

…over $initialDinosaurs as $dinosaurs and say, this->addDinosaur($dinosaur). That was the mistake that other programmer made: I'm using addDinosaur() instead of just setting the $dinosaurs property directly because that method contains the security checks. So... that should be it! Let's try phpspec…

…and, with any lucky, some security systems that - thanks to our tests - won't fail as soon as a storm rolls in or a developer leaves early for lunch. To make sure our dinosaurs don't once again rule the Earth, you should totally code…

…install code. It will change for every version of the install. Huh. Composer includes a bit of built-in security: a sha hash to make sure that the installer hasn't been tampered with. If we tried to use these 4 commands in Ansible, it…

…which will be a string. Eventually, in the security tutorial, we'll change this to be a relationship to a User entity. Use the 255 length and make it not nullable. Oh, and one more: a votes property that's an integer so that people…

…yes! Every record has isMe: true. Setting this to the correct value is probably the easiest part of the whole process. Start by adding a second argument to the constructor - Security $security - so we can get the authenticated user. I'll hit Alt+Enter and…