… Next, I want to make one more improvement to our test suite before we get back to talking about API Platform security. I want to create a base test class with some helper methods that will enable us to move fast and write clean code…

…We need to get the service out of the container that's responsible for encoding passwords. We can get that with self::$container->get('security.password_encoder'). We also could have used UserPasswordEncoderInterface::class as the service id - that's the type-hint we use…

… Okay. 6 to 7 hands. So, actually, can you raise your hands up? Who tests everything? How much security testing do we do? Performance testing? Visual regression testing? That all is testing, right? So, why I decided to do this talk was people came to…

…Okay? That's a simple one. It's more or less easier, but it can have some issues. Let's say that you want to apply some security updates. It can be more tricky. I usually prefer a multistep build process. This is my preference…

…data from headers, which, you know, it's not the best idea in terms of security or taking user content and like just dumping it into the session and serializing it, like you want to be really careful when you do things like that. Um…

…bugs so that trying really to analyze php on multiple levels of php code you have bugs, you have even vulnerabilities. So they have kind of security checks as well. You have those code smells. It's the things I want to talk about today…

…for example, it could be the groups of a user, because Symfony security has this concept of groups already. This can be implemented quite transparently: the reverse proxy does the job and the application doesn't really need to know about it that much. The…

…surprise: I love the Workflow Component. I use the Workflow component all over the place. If I have... the Symfony Security components have the concept of voters, which are basically: if someone wants to watch, view an advert, I got to make sure that advert…

…use symfony security:check, which is nice because it does not connect to the API. So it's, everything happens locally. So it clones a GitHub repository but then everything happens locally. So that's a nice way to not depend on security.symfony.com…

…say about the topic of services, and so many other parts of Symfony: configuration, Doctrine & the database, forms, Security and APIs, to just name a few. The Space Bar is far from being the galactic information source that we know it will be! But, congrats…

…getValues() and refresh the page... perfect! We're back to a regular array of items. Next: We can read from our new DragonTreasureApi resource, but we can't write to it yet. Let's create a DragonTreasureApiToEntityMapper and re-add things like security and validation.

…but instead of actually sending the verification email, we're just putting the verification URL directly into a flash message. It was a shortcut I made during the Security tutorial. But now, let's send a real email. I'll go to the bottom of…

…go... Twig is using htmlentities to output escape the text. Twig does that automatically for security: it protects against XSS attacks - that's when users try to enter JavaScript inside a question so that it will render & execute on your site. In this case, we…

…we didn't care about - is in .env.test. Revert it with: git checkout .env.test Woo! Let's find out what recipes we have left: composer recipes Woh! Only 3 main Symfony repositories left: security-bundle, translation and validator. Let's do those next.

…code. Flex has no effect on these: they upgrade normally, and that's fine. So upgrading the "patch" version of Symfony to get bug fixes and security releases is just as simple as running composer update "symfony/*". But to upgrade to the next minor version…

…inside Enclosure. Remove all this complicated stuff and, at the end, just say: || $dinosaur->hasSameDietAs($this->dinosaurs[0]). Run phpspec one more time: Got it! Next, let's talk a bit more about testing exceptions and finally add some Security to our dino park.

…API request, click into the Doctrine section then "view formatted query". Beautiful! The is_published and owner_id check comes from a Doctrine extension we created in the last tutorial and relates to security. And then it searches on the title or description fields. Pretty…

…for this is to also make sure that we set this field in the data persister. At the top, add one more argument - Security $security - and then initialize that property: Below, in persist() - we could add the logic in the if statement where we know…

…this in the browser. Go to /api/users.jsonld. And... oh! If you get "full authentication is required", that's our security system in action! Go team! In another tab, I'll go back to my homepage and hit log in. Refresh the original tab…

…like to do whenever I start a new project and when I download new dependency, I like play a game and it's called do you need this? So basically do you need security, if you're on a private network? Do you need forms…