…are working. We are denying access, sending a 401, and because of our security error handling in that ApiEntryPoint class, we’re sending a nice api problem format with the actual detail set to “Invalid Credentials.” Like before, this message comes from deep inside Silex…

… So let’s hook this up! Some of this is specific to Silex’s security system, but in case you’re using something else, we’ll stay high level enough to see what types of things you need to do in your system to make…

…client, but we absolutely don’t want to expose any of our internals. Make sure whatever logic you use here is very solid. #security Even our logic is a bit loose. For example, if we go to a URL that just doesn’t exist, the…

…them without the client's credentials, as you'll see. Having two keys instead of one is a method often used in security to make it harder for attackers to compromise a system. Fortunately, COOP does support refresh tokens. Open up the CoopOAuthController where we…

…id, redirect_uri and scope parameters. But we get an error: It's complaining about the redirect URL we're sending. For added security, OAuth servers allow, and sometimes require you to configure your redirect URL in your application. Go back to our application and…

…endpoint. Notice I'm giving the new user a blank password. Does that mean someone could login as the user by entering a blank password? That would be a huge security hole! The problem is that the user isn't choosing a password. In fact…

…is being saved, we’ll just ignore it. This is important because the function is called when any entity is saved: // src/Yoda/UserBundle/Doctrine/UserListener.php // ... public function prePersist(LifecycleEventArgs $args) { } Injecting the security.encoder_factory Dependency¶ We’re almost done. You’ve probably…

… Clearly that’s not the case: Symfony’s security system is smart enough to take the id and query for a full fresh copy of the User object on each request. We can see this right in the web debug toolbar: once a user is…

…exists, but it’s not actually used during login. To make this work, change the User class to implement AdvancedUserInterface instead of UserInterface: // src/Yoda/UserBundle/Entity/User.php // ... use Symfony\Component\Security\Core\User\AdvancedUserInterface; class User implements AdvancedUserInterface { } Tip For the OO geeks…

…strange, but stay with me. First, we ask Symfony for a special “encoder” object that knows how to encrypt our passwords. Remember the bcrypt config we put in security.yml? Yep, this object will use that. After we grab the encoder, we just call encodePassword()…

…imagine that park security wants to control park fences from a mobile app, while vacationing thousands of miles away. Feature: Remote fence control API In order to control fence security from anywhere As an API user I need to be able to POST JSON instructions…

…to the next pattern, let's take a look at a real-world example. Symfony leverages Chain of Responsibility in its security component. It uses a concept called "Voters" to determine if a user has access to a specific resource or not. But Symfony implements…

…on a Mac. Run: open bin/tailwindcss If this is the first time you've downloaded the file, it will ask you to verify that you do want to open it from a security standpoint. Okay! We now have the bin/tailwindcss executable, which does…

…inspire people to be the best chefs they can be... for their dogs. This is a pretty traditional Symfony app with a few controllers and some Twig templates. It also has two entities: A User entity for security, and a Recipe entity. On the site…

…added enable_authenticator_manager: true. This enables the new security system. We're going to talk about that later. For now, set this to false so that we're still using the old security system. It also added something called password_hashers, which replaces encoders…

…out all the way - I don't want to dive into the form system - but we are going to get it started. And this is going to lead us to a really interesting security situation. Over in src/Controller/QuestionController.php... find the show() action…

…really easy. We could just autowire the LoginFormAuthenticator service up here and pass it in. But, in our security.yaml file, our main way of authenticating is form_login: That does activate an authenticator service behind the scenes - just like our custom LoginFormAuthenticator. The tricky…

…in the database. I love that. This is all possible thanks to a powerful event listener system inside of security. Let's learn more about that next and see how we can leverage it to add CSRF protection to our login form... with about two…

…it in action. To start, we need to create a custom authentication exception class. This will serve as the "signal" that we're in this "account not verified" situation. In the Security/ directory, add a new class: how about AccountNotVerifiedAuthenticationException. Make it extend AuthenticationException. And…

…have access. That sounds like a pain in the butt! Fortunately, Symfony has a feature just for this called role hierarchy. Open up config/packages/security.yaml and, anywhere inside of here... but I'll put it near the top, add role_hierarchy. Below this…