…give them that new role. That's a bummer! But... don't worry! Symfony has our backs with a sweet feature called role_hierarchy. Open config/packages/security.yaml. Anywhere inside, I'll do it above firewalls, add role_hierarchy. Below, put ROLE_ADMIN set…

…work! Open ApiTokenAuthenticator. Ok: this is our second authenticator, so it's time to use our existing knowledge to kick some security butt! For supports(), our authenticator should only become active if the request has an Authorization header whose value starts with the word "Bearer"…

…serializer component! It's a kick butt way to turn objects into JSON, or any other format. I don't want to talk too much about the serializer right now: we're trying to learn security! But, I do want to use it. Find your…

…But! There's a cooler way. Add a 2nd argument to info: an array. Give it a user key - I'm just making that up - and set it to the user object: $this->security->getUser(): Unrelated to security, every method on the logger, like info()…

…getCredentials(), instead of returning, add $credentials = : Now, set the email onto the session with $request->getSession()->set(). Use a special key: Security - the one from the Security component - ::LAST_USERNAME and set this to $credentials['email']: Then, at the bottom, return $credentials: Try it…

…of this password encoding stuff for us. Nice! We just need to tell it which encoder algorithm to use. Go back to security.yaml. Add one new key: encoders. Below that, put the class name for your User class: App\Entity\User. And below that…

…at the beginning of every request, before the controllers? The logout process works the same way. All we need to do is tell Symfony what URL we want to use for logging out. In security.yaml, under your firewall, add a new key: logout and…

…To see if things are working, let's just dump($request->request->all()), then die(): I know, that looks funny. Unrelated to security, if you want to read POST data off of the request, you use the $request->request property. Anyways, let's try it…

…have a normal entity class that also has a getUsername() method and a getRoles() method. It's really, pretty boring. The other file that was modified was config/packages/security.yaml. Go back to your terminal and run: git diff to see what changed. Ah…

…Shift+Shift and search for this: AppVariable. Cool! Ignore the setter methods on top - these are just for setup. The AppVariable has a couple of handy methods: getToken() and getUser() both relate to security. Then, hey! There's our favorite getRequest() method, then getSession(), getEnvironment(…

…main repository is closely controlled for quality. The second - the "contrib" repository - has some basic checks, but the community can freely contribute recipes. For security reasons, when you download a package that installs a recipe from that repository, it will ask you first before installing…

…the tutorial/ directory, you should have a DataFixtures directory. Copy that into your AppBundle. These two classes build 3 Enclosures and also add some security to them. But, part of this code is using a setEnclosure() method on Dinosaur... and that doesn't exist! Open…

…top of every test method. But another great option is to override setUp() and add it there. Let's empty all three entities: Enclosure, Security and Dinosaur. For this method to work, we need a getEntityManager() method. At the bottom, add private function getEntityManager(). Then…

…puts the short name... so go copy the use statement and put it down here. Try it! Yes! One more test passing. I want to go through one more example next... and also add some security to the enclosures. Our guests have been terrorized enough.

…talks to the database! First, we need to finish our entities. Find Security and copy the id field. Open Dinosaur and paste this in. Do the same for Enclosure. We haven't needed these yet because we haven't touched the database at all. Now…

…PHP web server. Ok, load this up in your browser: http://localhost:8000. Welcome to AquaNote! This is the same project we've been building in our main Symfony tutorials, but without any security logic. Gasp! See that Login link? It's a lie! It…

…this is not the right use statement. I'll re-add TokenStorageInterface: make sure you choose the one from Security\Core\Authentication: In our method, fetch the user with $user = $this->tokenStorage->getToken()->getUser(). And if the User is not an instanceof our User…

…match what we put in the config: Notice the URL for this is just /genus/feed. It does not start with /easyadmin. And so, it's not protected by our access_control security. That should be enough to get started. Refresh! There's our link…

…into your browser! Ah, that's a little security check that prevents any non-local users from accessing our dev environment. Just for now, go into the web/ directory, open app_dev.php, and comment-out the two security lines: Refresh again! Hey, it's…

…return the exact same data we already have? Yes! We do this not because we need to, but for security. If we read the request JSON directly, it's possible that the request is coming from some external, mean-spirited person instead of from Stripe…