…In base.html.twig, add a link tag for build/layout.css: Copy that. We need to do this again on our two pages: app/Resources/FOSUserBundle/views/Security/login.html.twig. Override the block stylesheets, call parent() and add the link tag to login…

…joins over and fetches the related User data all at once... this entire page is built with one query: Well, except for the query that loads my security user from the database. So this is cool! Well, its maybe cool - as we talked about earlier…

…yep! "Filter by Tag!". By the way, going to app_dev.php only works because I've already modified some security logic in that file to allow me to access it: Ok, back in our local machine, run the playbook... this time with -t deploy…

…fix one more: the csrf notice. In this case, a config key was renamed from csrf_provider to csrf_token_generator in security.yml. A lot of changes are like this: simple renames: Clear the cache and refresh: And boom! The only deprecation left is…

…to see: you need to study the stack trace. This ultimately starts with AppKernel::registerContainerConfiguration() where our configuration files are loaded. The second is complaining about bad configuration in security.yml: that's also our fault, and we'll fix it in a minute. But…

…good. What else do we have? Check out the "Fence Security Activated" message on the site. Let's imagine we need to create an API where someone can make an API request to turn the fence security on or off from anywhere. For example, if…

…I want to end this course with a discussion. Some people wouldn't call this a security issue - maybe more of a hardening issue - but check this out. Log out and go back to the register page. Say we're trying to find out whether…

…s no Flex alias for this. So instead, install the actual package symfony/security-csrf: As soon as that package is installed, CSRF protection is enabled for all Symfony forms by default making your forms more secure out of the box. You can see this…

…things are going to empower you no matter what API you're building. In the next tutorial, we'll talk about users, security, custom validation, user-specific fields and other wild stuff. Let us know what you're building and, if you have any questions…

…security standpoint as we now need to worry about objects being edited or created via the same PUT operation. For that reason, as we go along, you'll see me remove the PUT operation in some cases. Next: let's get more complex with security…

…I'm on the Symfony repository. Hit "t" and search for JsonLoginAuthenticator. This is the code behind the json_login security authenticator. One common need with the JsonLoginAuthenticator is to use it like normal... but then take control of what happens on success: for example…

…day, the actions in our controller are real actions that are called like any normal action. And second, this is important for security. Because if we had only put the IsGranted above index() and not added the access_control, that would not have been enough…

…if you're allowed to edit or delete a treasure... that means you've already passed a security check... so we don't necessarily need to lock things down via this query extension. The other solution is to change the query to allow owners to…

…Oh, and though I didn't do it, we could also inject the Security service to allow admin users to do whatever they want. Up next: when we create a DragonTreasure, we must send the owner field. Let's finally make that optional. If we…

…This parameter is absolutely necessary for the API request to work, but isn't actually used by COOP. It's a security measure, and it must exactly equal the original redirect_uri that we used when we redirected the user. Ok, let's try it…

…have Ngrok running, we're still able to sync the LemonSqueezy customer ID with the user via JavaScript events. This approach simplifies local development a bit, but both ways are totally valid. Next: Let's tackle some potential security issues by preventing customer ID hijacking.

…getValues() and refresh the page... perfect! We're back to a regular array of items. Next: We can read from our new DragonTreasureApi resource, but we can't write to it yet. Let's create a DragonTreasureApiToEntityMapper and re-add things like security and validation.

…empty. After? We have _route, _controller, slug and hey! A few other things were added by other listeners related to security. That's not important for us - but still, interesting! Remove all that debug code. Before we find out how the request attributes are used…

…have a custom authenticator for our login form, so to make this actually work, we need to make some adjustments. Open src/Security/LoginFormAuthenticator. At the start of the onAuthenticationSuccess() method, add if ($targetPath = $request->query->get('_target_path')). Inside, return new RedirectResponse($targetPath)…

…test mode. In production, this would also list all the customer's orders. Okay, now let's turn our attention to a small security issue here. At the moment, we're filtering orders by the email users have registered with our site. But, in theory…