…out, it's super minor: It disables a validator in the test environment that makes a network request and is a security-related feature that just isn't needed in your tests. The last new file is in the same directory - webpack_encore.yaml: Which..…

…from here because it is also defined in translation.yaml... and someone realized it was pointless and a bit confusing to have it in both places. The cookie settings are a bit more interesting: they activate two security-related features. The first is cookie_secure…

…bigger. The other thing I want to show you is under "Recommendations" on the left. There are 3 types of recommendations... and we have one of each: the first is a security recommendation, the second is a quality recommendation and the third a performance recommendation…

…This is actually great. Really! The deploy command automatically checks your composer.lock file to see if you're using any dependencies with known security vulnerabilities. Some of my Symfony packages do have vulnerabilities... and if this were a real app, I would upgrade those…

…have an object that is instantiated on every request... but only needs to do real work in rare cases. Certain event subscribers - like our AgreeToTermsSubscriber - Symfony security voters & Twig extensions are other examples from Symfony. These services might be quick to instantiate... so no problem…

…keep going! Because the article {id} is in the URL, add an Article $article argument. Oh, and we need security! You can only upload a file if you have access to edit this article. In our app, we check that with this @IsGranted("MANAGE", subject=…

… Back in the controller, copy the $disposition line - we're going to put this back in a minute. Then, delete everything after the security check, paste the $disposition line, but comment it out for now. Ok, let's go steal some code from the docs…

…API, we would want to have a different endpoint for making a GET request to /admin/article/references/{id} that would return the JSON for that one reference. Inside, add the ArticleReference $reference argument and then we'll add our normal security check. In fact…

…references. Now add the methods="GET" - yes you can leave off the curly braces when there's just one method - and name="admin_article_list_references". Down in the method, add the Article argument and don't forget the security check: @IsGranted("MANAGE", subject="article")…

…the file directly: it's not public. Instead, we're going to link to a Symfony route and controller and that controller will check security and return the file to the user. Let's do this in ArticleReferenceAdminController. Add a new public function, how about…

…back over, find the security.rst file and scroll down to line 1269. Ah. This toctree thing is another feature of RST - it helps build the table of contents. Remove the security/target_path line. To make sure there aren't any other references, find…

…builds off of TargetPathTrait, let's see where that's documented: git grep TargetPathTrait Ok: apparently that's covered in some form_login.rst file. Go find that in PhpStorm: security/form_login.rst. Look all the way down at the bottom. Yep, here is…

… I'll double-click to get back into SecurityBundle. Because we want to test TargetPathHelper, the test should live in Tests/Security. Create a new PHP class called TargetPathHelperTest. Make this extend the normal TestCase from PHPUnit: Then add public function testSavePath(): For the body…

…terminal, run: git grep AppBundle Hey! Not too bad. And most of these are the same: calls to getRepository(). Start in security.yaml and do the same find and replace. You could do this for your entire project, but I'll play it safe. Now…

…So... why are we upgrading? So glad you asked: because the new version has a feature I really like! As soon as Composer finishes, go back to GenusAdminController. Instead of using @Security, use @IsGranted. This is similar, but simpler. For the value, you only need…

…enabled as the Security CSRF component is not installed. Ohhhh. Like translation and form, csrf_protection activates a component that we don't have installed! No problem! Go back to symfony.sh and search for "csrf". There it is! Run: composer require security-csrf By…

…I keep responsible version constraints in composer.json, ahem, no dev-master or * versions, this is pretty safe and also means I get bug fixes, security fixes and new features. And... hello Symfony 3.4! The best part? Ah, you guys already know it: thanks…

…trusted_proxies configuration was removed. Open up app/config/config.yml: there it is! Just take that out: The option was removed for security reasons. If you did have a value there, check out the docs to see the replacement. Ok, even though composer update…

…id isn't referenced anywhere, so remove that. The app.security.login_form_authenticator is used in two places: security.yml and also UserController: Copy the new service id - the class name. In security.yml, just replace the old with the new: Next, in UserController…

… First, autowiring looks for a service whose id exactly matches the type-hint. In other words, it looks for a service whose id is Symfony\Component\Security\Core\Encoder\UserPasswordEncoder: If that exists, it's used... always. This is the main way that autowiring works…