…is never, ever sent to our servers... which is the greatest news I have ever heard from a security standpoint. I do not want to handle your CC number: this would greatly increase the security requirements on my server. Instead, when you hit "Pay", this…

…the next parts, we're going to start adding big features: like talking to a database, forms, security and more. And when we do, I've got some exciting news: because of your work here, it's all going to make sense. Let's keep…

…along with security.yml and services.yml: The key point is that all of the files are just loading each other: it's all the same system. In fact, I could copy all of security.yml, paste it into config.yml, completely delete security.yml…

…best features of Twig is that it automatically escapes any HTML that you render. That gives you free security from XSS attacks. And for those few times when you do want to print HTML, just add the |raw filter: Refresh again: it's rending in…

…s lame. Of course, you can solve this with that group system we talked about earlier, but that's usually overkill. And, there's a simpler way. In security.yml, let's take advantage of something called role hierarchies. It's simple, it's awesome!…

…do nothing: Now, on to encoding that password. Symfony comes with a built-in service that's really good at encoding passwords. It's called security.password_encoder and if you looked it up on debug:container, its class is UserPasswordEncoder. We'll need that…

…RouterInterface: Use the Option+Enter shortcut again to set up that property: Down in getLoginUrl(), return $this->router->generate('security_login'): So what happens when authentication is successful? It's awesome: the user is automatically redirected back to the last page they tried to visit…

…thing I was talking about earlier. This will lead you to wonderful applications. There's really nothing that we can't do now in Symfony. In the next courses, we'll use all this to master new tools like forms and security. Seeya next time!

…that shows you exactly how long each part of your application took to render. This is amazing for debugging and profiling. There's also details in here on Twig, security, routes and other cool stuff. We'll keep exploring this as we go along. Ok…

…a $robot property and set it: In checkCredentials(), if (!$this->robot->doesRobotAllowAccess()) then throw a really clear new CustomUserMessageAuthenticationException() that says "RANDOM SECURITY ROBOT SAYS NO!": And I'll even put quotes around that. This is when we would normally go to services.yml and…

…and open up DefaultController. Go down to sillyLoginAction(). OK, pretend that something went wrong and we can't figure it out. If this security.authentication_utils is the problem, we might want to use dump() to print it out. Below that, throw a new Exception…

…now bin/console server:run: Try out /login. To use guard, we need a new class. I'll create a new directory called Security, but that's not important. Call the class WeirdFormAuthenticator.Next, make this class implement GuardAuthenticatorInterface or extend the slightly easier AbstractGuardAuthenticator: …

…the custom query builder. Now, if someone passes a programmer id that we do not own, the EntityType will automatically cause a validation error. Security is built-in. Head back to the terminal to try it! Awesome! Well, it failed - but look! It's just…

…client from starting a battle with a Programmer that they do not own? Right now - nothing, besides karma and trusting that humankind will do the right thing. Unfortunately, that doesn't usually pass a security audit. Let's be heros and fix this security hole!

…our start() method in this situation? So what gives? Open up security.yml: Here's the problem: we have a single firewall. When an anonymous request accesses the site and hits a page that requires a valid user, Symfony has to figure out what one…

…to hide the fact that the username was wrong, you can throw a BadCredentialsException instead - you'll see me do that in a second. Checking the password is easy: $isValid = $this->get('security.password_encoder') ->isPasswordValid(). Pass it the $user object and the raw…

…copy the second line to create a private key, but change its path to the var/jwt directory: This asks you for a password - give it one! It adds another layer of security in case somebody gets your private key. I'll use happyapi. Perfect…

…showAction will have an $id argument. From here, life is really familiar. First, do we need security? - always ask yourself that. I'm going to decide that anyone can fetch battle details out without being authenticated. So we won't add any protection. We will…

…put our first scenario here, which is going to be the working scenario for creating a token. Even though a token relates to security it’s really no different than any other resource we’re creating, like a programmer resource. So the scenario for this…

…src/KnpU/CodeBattle/Security/Authentication/ApiEntryPoint.php // ... use KnpU\CodeBattle\Api\ApiProblemResponseFactory; class ApiEntryPoint implements AuthenticationEntryPointInterface { } So now, when this object is created we’re going to have access to this ApiProblemResponseFactory. Down below, we can just use it: // src/KnpU/CodeBattle/Security/Authentication/ApiEntryPoint…