…if there is one, and if there is, call setIsMe(true) on it. Add public function __construct() with a Security $security argument. I'll hit Alt+Enter and go to "Initialize properties" to create that property and set it: Then down in onRequestEvent(), start with:…

…status code instead of allowing this: To fix that, we need to see if the user is an admin. Add a second argument to the constructor Security $security. I'll initialize this property: Then below, update the if statement: if the description is too short…

…I'll just create one... and log in is that user so that we have access to the PUT request: Thanks to the last tutorial, we already have security rules to prevent anyone from editing someone else's listing. Down here, for the JSON body…

…we need to make this userIsOwner() method... actually work! Add a constructor to the top of this class and autowire the Security service. I'll hit Alt -> Enter and go to "Initialize Fields" to create that property and set it. Down in the method…

…when a user is updating their password. We talk about that on an older Symfony 3 Security Tutorial. We're going to try a different approach - an approach that's more specific to API Platform. Before we get there, let's write a test to…

…overriding the first... so let's remove the extra one. Anyways, for our first test, I want to make sure this security is working. Add public function testCreateCheeseListing(). And inside, make sure this all isn't an elaborate dream with $this->assertEquals(42, 42). Ok…

…let's add this to the API for all users by adding @Groups("user:write"). This creates a huge security hole... so we'll come back to this in a few minutes and make sure that only admin users can write to this field. Let…

…bin/console make:voter Call it CheeseListingVoter. I commonly have one voter for each entity or "resource" that has complex access rules. This creates src/Security/Voter/CheeseListingVoter.php. Before we dive into the new class, go to CheeseListing. Instead of saying is_granted('ROLE…

…and things like this. In these tools are also available the security. So when you think about an API, you don't really think about security and you don't have to care about it because we did all the work. We prepared this for…

…So, one afternoon, in an office somewhere, uh, we were having a security scan, um, and certain requests were hanging on certain conditions. Um, and basically it boiled down to the fact that the text protocol of Memcached cannot really handle new lines in the…

…engage. Perfect! We still have access but... well... anyone has access to this page right now. The simplest way to enforce our custom security logic is to add it right in the controller. Check it out: if ($article->getAuthor() !== $this->getUser()) and if !$this…

…that same, big, adorable empty authenticator we saw earlier. To tell Symfony to use this, open config/packages/security.yaml and add the new class under authenticators: If you're using that newer, fancier version of this command, it already did this for you. Lucky…

…give them that new role. That's a bummer! But... don't worry! Symfony has our backs with a sweet feature called role_hierarchy. Open config/packages/security.yaml. Anywhere inside, I'll do it above firewalls, add role_hierarchy. Below, put ROLE_ADMIN set…

…work! Open ApiTokenAuthenticator. Ok: this is our second authenticator, so it's time to use our existing knowledge to kick some security butt! For supports(), our authenticator should only become active if the request has an Authorization header whose value starts with the word "Bearer"…

…serializer component! It's a kick butt way to turn objects into JSON, or any other format. I don't want to talk too much about the serializer right now: we're trying to learn security! But, I do want to use it. Find your…

…But! There's a cooler way. Add a 2nd argument to info: an array. Give it a user key - I'm just making that up - and set it to the user object: $this->security->getUser(): Unrelated to security, every method on the logger, like info()…

…getCredentials(), instead of returning, add $credentials = : Now, set the email onto the session with $request->getSession()->set(). Use a special key: Security - the one from the Security component - ::LAST_USERNAME and set this to $credentials['email']: Then, at the bottom, return $credentials: Try it…

…of this password encoding stuff for us. Nice! We just need to tell it which encoder algorithm to use. Go back to security.yaml. Add one new key: encoders. Below that, put the class name for your User class: App\Entity\User. And below that…

…at the beginning of every request, before the controllers? The logout process works the same way. All we need to do is tell Symfony what URL we want to use for logging out. In security.yaml, under your firewall, add a new key: logout and…

…To see if things are working, let's just dump($request->request->all()), then die(): I know, that looks funny. Unrelated to security, if you want to read POST data off of the request, you use the $request->request property. Anyways, let's try it…