…empty. After? We have _route, _controller, slug and hey! A few other things were added by other listeners related to security. That's not important for us - but still, interesting! Remove all that debug code. Before we find out how the request attributes are used…

…more time. The huge error is replaced by a much more pleasant validation message. Next: the author can upload a file reference... but it is literally impossible for them to download it. How can we make these private files accessible, but still check security first?

…it... but I don't really see the point. I'll keep absolute URLs always. Next: let's start uploading private assets: stuff that can't be put into the public/ directory because we need to check security before we let a user download it.

…is no different than setting any other field. Later, once we have a real security system, we'll start locking things down so that I can't create a CheeseListing and say that someone else owns it. Anyways, to make owner part of our API…

…eventually store the encoded password, which is not something that an API client will set directly. But... we're going to worry about all of that in our security tutorial. For now, because password is a required field in the database, let's temporarily make…

…we'll learn about other, API-Platform-specific stuff that you can put here, like access_control for security and ways to control the serialization process. In fact, let's learn about that process right now! How does API Platform transform our CheeseListing object - with…

…Code grant type and redirecting the user, we only really need to worry about the JavaScript origins. Google makes us fill these in for security purposes - a topic we'll cover later. When we're finished, we have a brand new Client ID and secret…

…but instead of actually sending the verification email, we're just putting the verification URL directly into a flash message. It was a shortcut I made during the Security tutorial. But now, let's send a real email. I'll go to the bottom of…

…huge step forward. Next, let's dial in on these remaining deprecations and work on squashing them. We're going to start with the elephant in the room: converting to the new security system. But don't worry! It's easier than you might think!

…If you wanted to change this data, you could do that by adding your own custom normalizer. We actually talk about this in our API Platform Security Tutorial. You could decorate the ProblemNormalizer... and maybe just add or tweak some data or you could create…

…resolver. Another resolver lives in a different directory - I'll hit Shift+Shift to open it: UserValueResolver.php. This resolver allows you to type-hint UserInterface on an argument to get your security User object. At this point, if we look back at ArticleController::show…

…we didn't care about - is in .env.test. Revert it with: git checkout .env.test Woo! Let's find out what recipes we have left: composer recipes Woh! Only 3 main Symfony repositories left: security-bundle, translation and validator. Let's do those next.

…forget to put security back: @IsGranted("MANAGE", subject="article"). In a real project, wherever I test my API endpoints - like Postman or via functional tests, I would actually authenticate myself properly so they worked, instead of temporarily hacking out security. Generally speaking, removing security is…

…want. That means, back in SecurityController, delete this line and add a new AuthenticationUtils $authenticationUtils argument. Done. The last spot is in UserController: we're using security.authentication.guard_handler. This time, let's guess the type-hint! Add a new argument: Guard... GuardAuthenticationHandler. That…

…using the module is pretty simple! We're just going to give it a lot of info about the image we want, the security group to use, the region and so on. Add a new task called "Create an Instance". Use the ec2 module and…

…for this is to also make sure that we set this field in the data persister. At the top, add one more argument - Security $security - and then initialize that property: Below, in persist() - we could add the logic in the if statement where we know…

…this in the browser. Go to /api/users.jsonld. And... oh! If you get "full authentication is required", that's our security system in action! Go team! In another tab, I'll go back to my homepage and hit log in. Refresh the original tab…

…like to do whenever I start a new project and when I download new dependency, I like play a game and it's called do you need this? So basically do you need security, if you're on a private network? Do you need forms…

…Then you need to, only thing that you need to do is bin/console maker:user. You will get fully working user with everything setup in security and the only thing in rest API that you need to implement some action. For example, registration action…

…for more complex control, hiding fields based on the user, adding custom fields based on the user, validating data... again... based on who is logged in and even controlling database queries based on security. That... was awesome! In an upcoming tutorial, we'll talk about…