…Then you need to, only thing that you need to do is bin/console maker:user. You will get fully working user with everything setup in security and the only thing in rest API that you need to implement some action. For example, registration action…

…for more complex control, hiding fields based on the user, adding custom fields based on the user, validating data... again... based on who is logged in and even controlling database queries based on security. That... was awesome! In an upcoming tutorial, we'll talk about…

…most importantly, it fixes our issue! Next, let's add the proper security logic to our class and then investigate another superpower of normalizers: the ability to add completely custom fields. We'll add a strange... but potentially useful boolean field to User called isMe.

… To find the currently-authenticated user, add an __construct() method, type-hint the Security service and then press Alt + Enter and select "Initialize fields" to create that property and set it. Next, inside the method, start by seeing if the owner was already set: if…

…the test environment, in order for Symfony's security system to "notice" that a user's roles were updated in the database, that user needs to log back in. It's a quirk of the security system and hopefully one we'll fix soon. Heck…

…is no different than setting any other field. Later, once we have a real security system, we'll start locking things down so that I can't create a CheeseListing and say that someone else owns it. Anyways, to make owner part of our API…

…eventually store the encoded password, which is not something that an API client will set directly. But... we're going to worry about all of that in our security tutorial. For now, because password is a required field in the database, let's temporarily make…

…we'll learn about other, API-Platform-specific stuff that you can put here, like access_control for security and ways to control the serialization process. In fact, let's learn about that process right now! How does API Platform transform our CheeseListing object - with…

…until now, if we've wanted to add a class attribute, we've done it from inside of our Twig template. For example, open security/register.html.twig. For the form start tag, we're passing an attr variable with a class key. Or, for…

…that info is loaded from the session and we're logged in. Cool! Look back at your security.yaml file. Remember this user provider thing that was setup for us? This is a class that helps with the process of loading the user info from…

…piece of configuration. In your application, open config/packages/framework.yaml. Yep, right on top: the secret key. This is used in various places for security, and, since it needs to be unique and secret, Symfony can't give you a default value. For our…

…On a real site, I should only be able to like this article one time. But, we'll need to talk about users and security before we can do that. Now that this is working, we can improve it! In the controller, we wrote some…

…stuff. But then, in just a couple of places in Symfony, the main ones being Twig extensions, event subscribers and security voters - a few topics we'll talk about in the future - you should consider using a service subscriber instead to avoid a performance hit.

…use statement. Do the same for DinosaurFactory. Ok, it's happy! Sure, the code is lacking the normal security and safeguards we expect when using Symfony's form system... but it's only a dinosaur park people! We do, however, have the success flash message!…

…by requiring this header to always be set, we give our application a bit more security: it removes the possibility that's somebody could create a CSRF attack on that endpoint... or some future endpoint that we don't send any data to. In other…

…sweet JavaScript. And we're just starting to scratch the surface of Symfony. What about talking to a database, using forms, setting up security or handling API input and validation? How and why should you register your own services? And what are event listeners? The…

…from Symfony's SecurityBundle... and we're not using that! If we need it, then you'll need to add it to LittleKernel and configure your security.yml file. For now, remove is_granted(): And try again. It alive... again! That's the MicroKernelTrait in…

…re throwing an exception! But bad news, our exception is the one weird guy in the whole system: instead of being handled here, it’s handled somewhere else entirely. ApiEntryPoint: Where Security Responses are Created¶ Without getting too far into things, I’ve already written…

…Code grant type and redirecting the user, we only really need to worry about the JavaScript origins. Google makes us fill these in for security purposes - a topic we'll cover later. When we're finished, we have a brand new Client ID and secret…

…This parameter is absolutely necessary for the API request to work, but isn't actually used by COOP. It's a security measure, and it must exactly equal the original redirect_uri that we used when we redirected the user. Ok, let's try it…