…overriding the first... so let's remove the extra one. Anyways, for our first test, I want to make sure this security is working. Add public function testCreateCheeseListing(). And inside, make sure this all isn't an elaborate dream with $this->assertEquals(42, 42). Ok…

…let's add this to the API for all users by adding @Groups("user:write"). This creates a huge security hole... so we'll come back to this in a few minutes and make sure that only admin users can write to this field. Let…

…bin/console make:voter Call it CheeseListingVoter. I commonly have one voter for each entity or "resource" that has complex access rules. This creates src/Security/Voter/CheeseListingVoter.php. Before we dive into the new class, go to CheeseListing. Instead of saying is_granted('ROLE…

…Guzzle. Let's do this! Make a request with $client->request(): make a POST request to /api/cheeses. How nice is that? We're going to focus our tests mostly on asserting security stuff. Because we haven't logged in, this request will not be…

…cheat for now. Find your terminal and run: php bin/console security:encode This is a fun utility where you can give it a plain-text password - I'll use foo - and it will give us back an encoded version of that password. Copy that…

…and things like this. In these tools are also available the security. So when you think about an API, you don't really think about security and you don't have to care about it because we did all the work. We prepared this for…

…So, one afternoon, in an office somewhere, uh, we were having a security scan, um, and certain requests were hanging on certain conditions. Um, and basically it boiled down to the fact that the text protocol of Memcached cannot really handle new lines in the…

…engage. Perfect! We still have access but... well... anyone has access to this page right now. The simplest way to enforce our custom security logic is to add it right in the controller. Check it out: if ($article->getAuthor() !== $this->getUser()) and if !$this…

…that same, big, adorable empty authenticator we saw earlier. To tell Symfony to use this, open config/packages/security.yaml and add the new class under authenticators: If you're using that newer, fancier version of this command, it already did this for you. Lucky…

…give them that new role. That's a bummer! But... don't worry! Symfony has our backs with a sweet feature called role_hierarchy. Open config/packages/security.yaml. Anywhere inside, I'll do it above firewalls, add role_hierarchy. Below, put ROLE_ADMIN set…

…work! Open ApiTokenAuthenticator. Ok: this is our second authenticator, so it's time to use our existing knowledge to kick some security butt! For supports(), our authenticator should only become active if the request has an Authorization header whose value starts with the word "Bearer"…

…serializer component! It's a kick butt way to turn objects into JSON, or any other format. I don't want to talk too much about the serializer right now: we're trying to learn security! But, I do want to use it. Find your…

…But! There's a cooler way. Add a 2nd argument to info: an array. Give it a user key - I'm just making that up - and set it to the user object: $this->security->getUser(): Unrelated to security, every method on the logger, like info()…

…getCredentials(), instead of returning, add $credentials = : Now, set the email onto the session with $request->getSession()->set(). Use a special key: Security - the one from the Security component - ::LAST_USERNAME and set this to $credentials['email']: Then, at the bottom, return $credentials: Try it…

…of this password encoding stuff for us. Nice! We just need to tell it which encoder algorithm to use. Go back to security.yaml. Add one new key: encoders. Below that, put the class name for your User class: App\Entity\User. And below that…

…at the beginning of every request, before the controllers? The logout process works the same way. All we need to do is tell Symfony what URL we want to use for logging out. In security.yaml, under your firewall, add a new key: logout and…

…To see if things are working, let's just dump($request->request->all()), then die(): I know, that looks funny. Unrelated to security, if you want to read POST data off of the request, you use the $request->request property. Anyways, let's try it…

…have a normal entity class that also has a getUsername() method and a getRoles() method. It's really, pretty boring. The other file that was modified was config/packages/security.yaml. Go back to your terminal and run: git diff to see what changed. Ah…

…Shift+Shift and search for this: AppVariable. Cool! Ignore the setter methods on top - these are just for setup. The AppVariable has a couple of handy methods: getToken() and getUser() both relate to security. Then, hey! There's our favorite getRequest() method, then getSession(), getEnvironment(…

…main repository is closely controlled for quality. The second - the "contrib" repository - has some basic checks, but the community can freely contribute recipes. For security reasons, when you download a package that installs a recipe from that repository, it will ask you first before installing…