…once it's uploaded, we'll need a way to link to that file... except if you need to do a security check before letting the user download the file. Then you'll need to handle things in a totally different way. Um... so wow…

…back over, find the security.rst file and scroll down to line 1269. Ah. This toctree thing is another feature of RST - it helps build the table of contents. Remove the security/target_path line. To make sure there aren't any other references, find…

…builds off of TargetPathTrait, let's see where that's documented: git grep TargetPathTrait Ok: apparently that's covered in some form_login.rst file. Go find that in PhpStorm: security/form_login.rst. Look all the way down at the bottom. Yep, here is…

… I'll double-click to get back into SecurityBundle. Because we want to test TargetPathHelper, the test should live in Tests/Security. Create a new PHP class called TargetPathHelperTest. Make this extend the normal TestCase from PHPUnit: Then add public function testSavePath(): For the body…

…terminal, run: git grep AppBundle Hey! Not too bad. And most of these are the same: calls to getRepository(). Start in security.yaml and do the same find and replace. You could do this for your entire project, but I'll play it safe. Now…

…So... why are we upgrading? So glad you asked: because the new version has a feature I really like! As soon as Composer finishes, go back to GenusAdminController. Instead of using @Security, use @IsGranted. This is similar, but simpler. For the value, you only need…

…trusted_proxies configuration was removed. Open up app/config/config.yml: there it is! Just take that out: The option was removed for security reasons. If you did have a value there, check out the docs to see the replacement. Ok, even though composer update…

…id isn't referenced anywhere, so remove that. The app.security.login_form_authenticator is used in two places: security.yml and also UserController: Copy the new service id - the class name. In security.yml, just replace the old with the new: Next, in UserController…

… First, autowiring looks for a service whose id exactly matches the type-hint. In other words, it looks for a service whose id is Symfony\Component\Security\Core\Encoder\UserPasswordEncoder: If that exists, it's used... always. This is the main way that autowiring works…

…In base.html.twig, add a link tag for build/layout.css: Copy that. We need to do this again on our two pages: app/Resources/FOSUserBundle/views/Security/login.html.twig. Override the block stylesheets, call parent() and add the link tag to login…

…joins over and fetches the related User data all at once... this entire page is built with one query: Well, except for the query that loads my security user from the database. So this is cool! Well, its maybe cool - as we talked about earlier…

…yep! "Filter by Tag!". By the way, going to app_dev.php only works because I've already modified some security logic in that file to allow me to access it: Ok, back in our local machine, run the playbook... this time with -t deploy…

…install code. It will change for every version of the install. Huh. Composer includes a bit of built-in security: a sha hash to make sure that the installer hasn't been tampered with. If we tried to use these 4 commands in Ansible, it…

…fix one more: the csrf notice. In this case, a config key was renamed from csrf_provider to csrf_token_generator in security.yml. A lot of changes are like this: simple renames: Clear the cache and refresh: And boom! The only deprecation left is…

…to see: you need to study the stack trace. This ultimately starts with AppKernel::registerContainerConfiguration() where our configuration files are loaded. The second is complaining about bad configuration in security.yml: that's also our fault, and we'll fix it in a minute. But…

…exchanging an authorization code for a token, and using the token; Authentication (single sign-on) using OAuth; Handling expired tokens; Using refresh tokens; Integrating and authentication with Facebook; OAuth integration with Google+; What to look out for with security and how you can tighten things.

…I want to end this course with a discussion. Some people wouldn't call this a security issue - maybe more of a hardening issue - but check this out. Log out and go back to the register page. Say we're trying to find out whether…

…s no Flex alias for this. So instead, install the actual package symfony/security-csrf: As soon as that package is installed, CSRF protection is enabled for all Symfony forms by default making your forms more secure out of the box. You can see this…

…things are going to empower you no matter what API you're building. In the next tutorial, we'll talk about users, security, custom validation, user-specific fields and other wild stuff. Let us know what you're building and, if you have any questions…

…paste... and we can use any future expiration date for now. I'll say "12/25", and use any three numbers for the security code. This also requires us to enter a billing address. If we try to click "Buy" without one, we get a…