…message: {user} is voting on answer {answer} Pass this a second argument, which is called the logger "context". This is unrelated to security... it's just kind of cool. The second argument is an array of any extra data that you want to store along…

…they're basically doing the same thing that we are. So let's use this instead of our custom authenticator... which I would do in a real project unless I need the flexibility of a custom authenticator. In security.yaml, comment-out our customer authenticator..…

…see that it's super simple: it just reads a very specific key from the session. This is the key that the security system sets when an anonymous user tries to access a protected page. Let's try this thing! We're already logged out…

…none of our authenticators provide an entry point... so let's add one! Open up our authenticator: src/Security/LoginFormAuthenticator.php. If you want your authenticator to provide an entry point, all you need to do is implement a new interface: AuthenticationEntryPointInterface: This requires the…

…and we're implementing PasswordAuthenticatedUserInterface, I'm going to remove this comment above the method: Ok, let's forget about security for a minute. Instead, focus on the fact that we need to be able to store a unique password for each user in the…

…security.yaml. Anywhere under our firewall, add logout: true: Internally, this activates a "listener" that looks for any requests to /logout. And actually, instead of just saying logout: true, you can customize how this works. Find your terminal and run: symfony console debug:config security…

…variable is literally going to be an AuthenticationException object. And remember, to figure out what went wrong, all AuthenticationException objects have a getMessageKey() method that returns an explanation. In templates/security/login.html.twig, let's render that. Right after the h1, say if error…

…values and the private key to decrypt them. Storing the secrets in plain text but removing the decrypt key from production is really the same thing from a security standpoint. The point is: there's no security difference. Let's delete the .env.prod.local…

…MAILER_DSN secret... but add an extra --local flag to the end: So far... this looks identical to before. I'll paste in my Mailtrap value... which the command hides for security reasons. And... fascinating! This didn't change our dev vault at all! Nope…

…out, it's super minor: It disables a validator in the test environment that makes a network request and is a security-related feature that just isn't needed in your tests. The last new file is in the same directory - webpack_encore.yaml: Which..…

…from here because it is also defined in translation.yaml... and someone realized it was pointless and a bit confusing to have it in both places. The cookie settings are a bit more interesting: they activate two security-related features. The first is cookie_secure…

…bigger. The other thing I want to show you is under "Recommendations" on the left. There are 3 types of recommendations... and we have one of each: the first is a security recommendation, the second is a quality recommendation and the third a performance recommendation…

…This is actually great. Really! The deploy command automatically checks your composer.lock file to see if you're using any dependencies with known security vulnerabilities. Some of my Symfony packages do have vulnerabilities... and if this were a real app, I would upgrade those…

…have an object that is instantiated on every request... but only needs to do real work in rare cases. Certain event subscribers - like our AgreeToTermsSubscriber - Symfony security voters & Twig extensions are other examples from Symfony. These services might be quick to instantiate... so no problem…

…keep going! Because the article {id} is in the URL, add an Article $article argument. Oh, and we need security! You can only upload a file if you have access to edit this article. In our app, we check that with this @IsGranted("MANAGE", subject=…

… Back in the controller, copy the $disposition line - we're going to put this back in a minute. Then, delete everything after the security check, paste the $disposition line, but comment it out for now. Ok, let's go steal some code from the docs…

…API, we would want to have a different endpoint for making a GET request to /admin/article/references/{id} that would return the JSON for that one reference. Inside, add the ArticleReference $reference argument and then we'll add our normal security check. In fact…

…references. Now add the methods="GET" - yes you can leave off the curly braces when there's just one method - and name="admin_article_list_references". Down in the method, add the Article argument and don't forget the security check: @IsGranted("MANAGE", subject="article")…

…the file directly: it's not public. Instead, we're going to link to a Symfony route and controller and that controller will check security and return the file to the user. Let's do this in ArticleReferenceAdminController. Add a new public function, how about…

…things into the public/ directory: they will be publicly accessible. We'll talk about private uploads soon - those are files where you need to do some security checks before you allow a user to see them. Change the directory to %kernel.project_dir% and then…