…piece of configuration. In your application, open config/packages/framework.yaml. Yep, right on top: the secret key. This is used in various places for security, and, since it needs to be unique and secret, Symfony can't give you a default value. For our…

…On a real site, I should only be able to like this article one time. But, we'll need to talk about users and security before we can do that. Now that this is working, we can improve it! In the controller, we wrote some…

…stuff. But then, in just a couple of places in Symfony, the main ones being Twig extensions, event subscribers and security voters - a few topics we'll talk about in the future - you should consider using a service subscriber instead to avoid a performance hit.

…say about the topic of services, and so many other parts of Symfony: configuration, Doctrine & the database, forms, Security and APIs, to just name a few. The Space Bar is far from being the galactic information source that we know it will be! But, congrats…

…use statement. Do the same for DinosaurFactory. Ok, it's happy! Sure, the code is lacking the normal security and safeguards we expect when using Symfony's form system... but it's only a dinosaur park people! We do, however, have the success flash message!…

…sweet JavaScript. And we're just starting to scratch the surface of Symfony. What about talking to a database, using forms, setting up security or handling API input and validation? How and why should you register your own services? And what are event listeners? The…

…from Symfony's SecurityBundle... and we're not using that! If we need it, then you'll need to add it to LittleKernel and configure your security.yml file. For now, remove is_granted(): And try again. It alive... again! That's the MicroKernelTrait in…

…re throwing an exception! But bad news, our exception is the one weird guy in the whole system: instead of being handled here, it’s handled somewhere else entirely. ApiEntryPoint: Where Security Responses are Created¶ Without getting too far into things, I’ve already written…

…there’s no downside here - make sure you have one of these on your server. And on that note, PHP typically gets faster from version to version. So staying on the latest version is good for more than just security and features. Thanks PHPeeps! Ok…

…toolbar, and you may end up loving it even more than the console. It tells us which controller was rendered, the page load time, memory footprint, security info, form details and more. It's added automatically to any page that has a valid HTML structure…

…but instead of actually sending the verification email, we're just putting the verification URL directly into a flash message. It was a shortcut I made during the Security tutorial. But now, let's send a real email. I'll go to the bottom of…

…huge step forward. Next, let's dial in on these remaining deprecations and work on squashing them. We're going to start with the elephant in the room: converting to the new security system. But don't worry! It's easier than you might think!

…config is no config... which tells Doctrine to figure out things for us. Once again, add all these changes, commit, and... let's keep going! Well, let's keep going in the next chapter, where we upgrade DoctrineExtensionsBundle, some debug recipes, routing, security and more!

…go... Twig is using htmlentities to output escape the text. Twig does that automatically for security: it protects against XSS attacks - that's when users try to enter JavaScript inside a question so that it will render & execute on your site. In this case, we…

…that would awesome. This is probably even better: let's chat about password hashing algorithms. Trust me, it's actually pretty neat stuff. Specifically, I want to talk about safely upgrading hashed passwords in your database to stay up-to-date with security best-practices.

…we didn't care about - is in .env.test. Revert it with: git checkout .env.test Woo! Let's find out what recipes we have left: composer recipes Woh! Only 3 main Symfony repositories left: security-bundle, translation and validator. Let's do those next.

…forget to put security back: @IsGranted("MANAGE", subject="article"). In a real project, wherever I test my API endpoints - like Postman or via functional tests, I would actually authenticate myself properly so they worked, instead of temporarily hacking out security. Generally speaking, removing security is…

…more time. The huge error is replaced by a much more pleasant validation message. Next: the author can upload a file reference... but it is literally impossible for them to download it. How can we make these private files accessible, but still check security first?

…it... but I don't really see the point. I'll keep absolute URLs always. Next: let's start uploading private assets: stuff that can't be put into the public/ directory because we need to check security before we let a user download it.

…old! Let's try one of these commands! ./bin/console make:voter Call it RandomAccessVoter: we'll create a voter that randomly gives us access. Fun! Open the new class in src/Security/Voter. This comes pre-generated with real-world example code. In supports()…