…copy the second line to create a private key, but change its path to the var/jwt directory: This asks you for a password - give it one! It adds another layer of security in case somebody gets your private key. I'll use happyapi. Perfect…

…client, but we absolutely don’t want to expose any of our internals. Make sure whatever logic you use here is very solid. #security Even our logic is a bit loose. For example, if we go to a URL that just doesn’t exist, the…

…them without the client's credentials, as you'll see. Having two keys instead of one is a method often used in security to make it harder for attackers to compromise a system. Fortunately, COOP does support refresh tokens. Open up the CoopOAuthController where we…

…inspire people to be the best chefs they can be... for their dogs. This is a pretty traditional Symfony app with a few controllers and some Twig templates. It also has two entities: A User entity for security, and a Recipe entity. On the site…

…added enable_authenticator_manager: true. This enables the new security system. We're going to talk about that later. For now, set this to false so that we're still using the old security system. It also added something called password_hashers, which replaces encoders…

…ones, like ResponseListener. Let's open that one up. I'll hit Shift+Shift to open ResponseListener.php: get the one from http-kernel/, not security. It says: ResponseListener fixes the Response headers based on the Request. Let's... find out what that means. Inside…

…bigger. The other thing I want to show you is under "Recommendations" on the left. There are 3 types of recommendations... and we have one of each: the first is a security recommendation, the second is a quality recommendation and the third a performance recommendation…

…This is actually great. Really! The deploy command automatically checks your composer.lock file to see if you're using any dependencies with known security vulnerabilities. Some of my Symfony packages do have vulnerabilities... and if this were a real app, I would upgrade those…

… Back in the controller, copy the $disposition line - we're going to put this back in a minute. Then, delete everything after the security check, paste the $disposition line, but comment it out for now. Ok, let's go steal some code from the docs…

…and, with any lucky, some security systems that - thanks to our tests - won't fail as soon as a storm rolls in or a developer leaves early for lunch. To make sure our dinosaurs don't once again rule the Earth, you should totally code…

…I keep responsible version constraints in composer.json, ahem, no dev-master or * versions, this is pretty safe and also means I get bug fixes, security fixes and new features. And... hello Symfony 3.4! The best part? Ah, you guys already know it: thanks…

…yep! "Filter by Tag!". By the way, going to app_dev.php only works because I've already modified some security logic in that file to allow me to access it: Ok, back in our local machine, run the playbook... this time with -t deploy…

…install code. It will change for every version of the install. Huh. Composer includes a bit of built-in security: a sha hash to make sure that the installer hasn't been tampered with. If we tried to use these 4 commands in Ansible, it…

…which will be a string. Eventually, in the security tutorial, we'll change this to be a relationship to a User entity. Use the 255 length and make it not nullable. Oh, and one more: a votes property that's an integer so that people…

…yes! Every record has isMe: true. Setting this to the correct value is probably the easiest part of the whole process. Start by adding a second argument to the constructor - Security $security - so we can get the authenticated user. I'll hit Alt+Enter and…

…status code instead of allowing this: To fix that, we need to see if the user is an admin. Add a second argument to the constructor Security $security. I'll initialize this property: Then below, update the if statement: if the description is too short…

…I'll just create one... and log in is that user so that we have access to the PUT request: Thanks to the last tutorial, we already have security rules to prevent anyone from editing someone else's listing. Down here, for the JSON body…

…hear: SPF, DKIM and DMARC. Here's the 60 second explanation of the first two. Both SFP and DKIM are security mechanisms where you can set specific DNS records that will say exactly who is allowed to send emails from your domain. SPF works by…

…we need to make this userIsOwner() method... actually work! Add a constructor to the top of this class and autowire the Security service. I'll hit Alt -> Enter and go to "Initialize Fields" to create that property and set it. Down in the method…

…when a user is updating their password. We talk about that on an older Symfony 3 Security Tutorial. We're going to try a different approach - an approach that's more specific to API Platform. Before we get there, let's write a test to…