…paste... and we can use any future expiration date for now. I'll say "12/25", and use any three numbers for the security code. This also requires us to enter a billing address. If we try to click "Buy" without one, we get a…

…soon. For the else, this is when the user does not send an owner field. To set it to the currently authenticated user, on top, inject the Security service onto a new property. Then back below, set owner to $this->security->getUser(). Beautiful! We are…

…admin somehow got the "Delete" URL for an approved question, the delete action would still work. The action itself isn't secure. To give us that extra layer of security, right before an entity is deleted, let's check to see if it's approved…

…prevent the user from logging in until they've verified their email. To do that, we first need to learn about the events that happen inside of the security system. And to show off those, we'll leverage a really cool new feature: login throttling…

…it to see if the User is logged in because this will return null if they're not. A more "official" way to do this would be to use isGranted() - that's another method on the Security class - and check for IS_AUTHENTICATED_REMEMBERED: Anyways…

…resolver. Another resolver lives in a different directory - I'll hit Shift+Shift to open it: UserValueResolver.php. This resolver allows you to type-hint UserInterface on an argument to get your security User object. At this point, if we look back at ArticleController::show…

…we'll learn about other, API-Platform-specific stuff that you can put here, like access_control for security and ways to control the serialization process. In fact, let's learn about that process right now! How does API Platform transform our CheeseListing object - with…

…by requiring this header to always be set, we give our application a bit more security: it removes the possibility that's somebody could create a CSRF attack on that endpoint... or some future endpoint that we don't send any data to. In other…

…Code grant type and redirecting the user, we only really need to worry about the JavaScript origins. Google makes us fill these in for security purposes - a topic we'll cover later. When we're finished, we have a brand new Client ID and secret…

… Login as Wayne. Remember, he has ROLE_ADMIN, which also means he has ROLE_EVENT_CREATE because of the role_hierarchy section in security.yml. Now, fill in some basic data and submit it. To see the result, use the query tool to list the…

…you would need to turn it into a UserApiRead and return that. Anyway, that's definitely more advanced, but if it's interesting, and you try it, let me know! Next up: Let's polish our new API resource by re-adding validation and security.

…your browser, refresh this page, and... oh... Full authentication is required to access this resource. Of course. That's because we added security! Head back over to the homepage, click this username and password shortcut... boop... and now try to refresh that page. It works…

…we need to call ->hashPassword() instead of ->encodePassword(). Done! Just one more spot where we need this same change: src/Security/LoginFormAuthenticator.php. We're going to refactor this class later to use the new security system... but let's at least get it working…

…the value, open .env.local, copy the long DSN string, then paste here. You won't see the value because the command is hiding it for security purposes. And... boom! This generated the prod vault and encrypted the secret. Check out config/secrets/prod. It…

…If you wanted to change this data, you could do that by adding your own custom normalizer. We actually talk about this in our API Platform Security Tutorial. You could decorate the ProblemNormalizer... and maybe just add or tweak some data or you could create…

…code. Flex has no effect on these: they upgrade normally, and that's fine. So upgrading the "patch" version of Symfony to get bug fixes and security releases is just as simple as running composer update "symfony/*". But to upgrade to the next minor version…

…inside Enclosure. Remove all this complicated stuff and, at the end, just say: || $dinosaur->hasSameDietAs($this->dinosaurs[0]). Run phpspec one more time: Got it! Next, let's talk a bit more about testing exceptions and finally add some Security to our dino park.

…API request, click into the Doctrine section then "view formatted query". Beautiful! The is_published and owner_id check comes from a Doctrine extension we created in the last tutorial and relates to security. And then it searches on the title or description fields. Pretty…

…for this is to also make sure that we set this field in the data persister. At the top, add one more argument - Security $security - and then initialize that property: Below, in persist() - we could add the logic in the if statement where we know…

…this in the browser. Go to /api/users.jsonld. And... oh! If you get "full authentication is required", that's our security system in action! Go team! In another tab, I'll go back to my homepage and hit log in. Refresh the original tab…