…things are going to empower you no matter what API you're building. In the next tutorial, we'll talk about users, security, custom validation, user-specific fields and other wild stuff. Let us know what you're building and, if you have any questions…

…day, the actions in our controller are real actions that are called like any normal action. And second, this is important for security. Because if we had only put the IsGranted above index() and not added the access_control, that would not have been enough…

…paste... and we can use any future expiration date for now. I'll say "12/25", and use any three numbers for the security code. This also requires us to enter a billing address. If we try to click "Buy" without one, we get a…

…if you're allowed to edit or delete a treasure... that means you've already passed a security check... so we don't necessarily need to lock things down via this query extension. The other solution is to change the query to allow owners to…

…Oh, and though I didn't do it, we could also inject the Security service to allow admin users to do whatever they want. Up next: when we create a DragonTreasure, we must send the owner field. Let's finally make that optional. If we…

…I'm on the Symfony repository. Hit "t" and search for JsonLoginAuthenticator. This is the code behind the json_login security authenticator. One common need with the JsonLoginAuthenticator is to use it like normal... but then take control of what happens on success: for example…

…admin somehow got the "Delete" URL for an approved question, the delete action would still work. The action itself isn't secure. To give us that extra layer of security, right before an entity is deleted, let's check to see if it's approved…

…test mode. In production, this would also list all the customer's orders. Okay, now let's turn our attention to a small security issue here. At the moment, we're filtering orders by the email users have registered with our site. But, in theory…

…soon. For the else, this is when the user does not send an owner field. To set it to the currently authenticated user, on top, inject the Security service onto a new property. Then back below, set owner to $this->security->getUser(). Beautiful! We are…

…let's say you have a bug in production. How would you replicate that in a local environment? If you're dealing with a monolith, maybe depending upon your security requirements, you clone the database? Or if you're actually doing things well and GDPR…

…have Ngrok running, we're still able to sync the LemonSqueezy customer ID with the user via JavaScript events. This approach simplifies local development a bit, but both ways are totally valid. Next: Let's tackle some potential security issues by preventing customer ID hijacking.

…have a custom authenticator for our login form, so to make this actually work, we need to make some adjustments. Open src/Security/LoginFormAuthenticator. At the start of the onAuthenticationSuccess() method, add if ($targetPath = $request->query->get('_target_path')). Inside, return new RedirectResponse($targetPath)…

…you would need to turn it into a UserApiRead and return that. Anyway, that's definitely more advanced, but if it's interesting, and you try it, let me know! Next up: Let's polish our new API resource by re-adding validation and security.

…your browser, refresh this page, and... oh... Full authentication is required to access this resource. Of course. That's because we added security! Head back over to the homepage, click this username and password shortcut... boop... and now try to refresh that page. It works…

…security standpoint as we now need to worry about objects being edited or created via the same PUT operation. For that reason, as we go along, you'll see me remove the PUT operation in some cases. Next: let's get more complex with security…

…we need to call ->hashPassword() instead of ->encodePassword(). Done! Just one more spot where we need this same change: src/Security/LoginFormAuthenticator.php. We're going to refactor this class later to use the new security system... but let's at least get it working…

…empty. After? We have _route, _controller, slug and hey! A few other things were added by other listeners related to security. That's not important for us - but still, interesting! Remove all that debug code. Before we find out how the request attributes are used…

…If you wanted to change this data, you could do that by adding your own custom normalizer. We actually talk about this in our API Platform Security Tutorial. You could decorate the ProblemNormalizer... and maybe just add or tweak some data or you could create…

…resolver. Another resolver lives in a different directory - I'll hit Shift+Shift to open it: UserValueResolver.php. This resolver allows you to type-hint UserInterface on an argument to get your security User object. At this point, if we look back at ArticleController::show…

…want. That means, back in SecurityController, delete this line and add a new AuthenticationUtils $authenticationUtils argument. Done. The last spot is in UserController: we're using security.authentication.guard_handler. This time, let's guess the type-hint! Add a new argument: Guard... GuardAuthenticationHandler. That…