…from here because it is also defined in translation.yaml... and someone realized it was pointless and a bit confusing to have it in both places. The cookie settings are a bit more interesting: they activate two security-related features. The first is cookie_secure…

…over $initialDinosaurs as $dinosaurs and say, this->addDinosaur($dinosaur). That was the mistake that other programmer made: I'm using addDinosaur() instead of just setting the $dinosaurs property directly because that method contains the security checks. So... that should be it! Let's try phpspec…

…back over, find the security.rst file and scroll down to line 1269. Ah. This toctree thing is another feature of RST - it helps build the table of contents. Remove the security/target_path line. To make sure there aren't any other references, find…

…builds off of TargetPathTrait, let's see where that's documented: git grep TargetPathTrait Ok: apparently that's covered in some form_login.rst file. Go find that in PhpStorm: security/form_login.rst. Look all the way down at the bottom. Yep, here is…

… I'll double-click to get back into SecurityBundle. Because we want to test TargetPathHelper, the test should live in Tests/Security. Create a new PHP class called TargetPathHelperTest. Make this extend the normal TestCase from PHPUnit: Then add public function testSavePath(): For the body…

…terminal, run: git grep AppBundle Hey! Not too bad. And most of these are the same: calls to getRepository(). Start in security.yaml and do the same find and replace. You could do this for your entire project, but I'll play it safe. Now…

…So... why are we upgrading? So glad you asked: because the new version has a feature I really like! As soon as Composer finishes, go back to GenusAdminController. Instead of using @Security, use @IsGranted. This is similar, but simpler. For the value, you only need…

…enabled as the Security CSRF component is not installed. Ohhhh. Like translation and form, csrf_protection activates a component that we don't have installed! No problem! Go back to symfony.sh and search for "csrf". There it is! Run: composer require security-csrf By…

…trusted_proxies configuration was removed. Open up app/config/config.yml: there it is! Just take that out: The option was removed for security reasons. If you did have a value there, check out the docs to see the replacement. Ok, even though composer update…

…id isn't referenced anywhere, so remove that. The app.security.login_form_authenticator is used in two places: security.yml and also UserController: Copy the new service id - the class name. In security.yml, just replace the old with the new: Next, in UserController…

… First, autowiring looks for a service whose id exactly matches the type-hint. In other words, it looks for a service whose id is Symfony\Component\Security\Core\Encoder\UserPasswordEncoder: If that exists, it's used... always. This is the main way that autowiring works…

…In base.html.twig, add a link tag for build/layout.css: Copy that. We need to do this again on our two pages: app/Resources/FOSUserBundle/views/Security/login.html.twig. Override the block stylesheets, call parent() and add the link tag to login…

…joins over and fetches the related User data all at once... this entire page is built with one query: Well, except for the query that loads my security user from the database. So this is cool! Well, its maybe cool - as we talked about earlier…

…fix one more: the csrf notice. In this case, a config key was renamed from csrf_provider to csrf_token_generator in security.yml. A lot of changes are like this: simple renames: Clear the cache and refresh: And boom! The only deprecation left is…

…to see: you need to study the stack trace. This ultimately starts with AppKernel::registerContainerConfiguration() where our configuration files are loaded. The second is complaining about bad configuration in security.yml: that's also our fault, and we'll fix it in a minute. But…

…good. What else do we have? Check out the "Fence Security Activated" message on the site. Let's imagine we need to create an API where someone can make an API request to turn the fence security on or off from anywhere. For example, if…

…s no Flex alias for this. So instead, install the actual package symfony/security-csrf: As soon as that package is installed, CSRF protection is enabled for all Symfony forms by default making your forms more secure out of the box. You can see this…

…things are going to empower you no matter what API you're building. In the next tutorial, we'll talk about users, security, custom validation, user-specific fields and other wild stuff. Let us know what you're building and, if you have any questions…

…day, the actions in our controller are real actions that are called like any normal action. And second, this is important for security. Because if we had only put the IsGranted above index() and not added the access_control, that would not have been enough…

…paste... and we can use any future expiration date for now. I'll say "12/25", and use any three numbers for the security code. This also requires us to enter a billing address. If we try to click "Buy" without one, we get a…