CSRF Protection Part 2
…by requiring this header to always be set, we give our application a bit
more security: it removes the possibility that's somebody could create a CSRF
attack on that endpoint... or some future endpoint that we don't send any data to.
In other…
Micro Symfony via MicroKernelTrait
…from Symfony's SecurityBundle... and we're not using that! If we need it, then
you'll need to add it to LittleKernel and configure your security.yml file.
For now, remove is_granted():
And try again.
It alive... again! That's the MicroKernelTrait in…
Requiring Authentication
…re throwing an exception! But bad news,
our exception is the one weird guy in the whole system: instead of being
handled here, it’s handled somewhere else entirely.
ApiEntryPoint: Where Security Responses are Created¶
Without getting too far into things, I’ve already written…
Deployment
…there’s no downside here - make sure you have one of
these on your server.
And on that note, PHP typically gets faster from version to version. So staying
on the latest version is good for more than just security and features. Thanks
PHPeeps!
Ok…
ManyToOne Doctrine Relationships
… Login as Wayne. Remember, he has ROLE_ADMIN, which also
means he has ROLE_EVENT_CREATE because of the role_hierarchy section
in security.yml.
Now, fill in some basic data and submit it. To see the result, use the query
tool to list the…
Twig
…toolbar, and you may
end up loving it even more than the console.
It tells us which controller was rendered, the page load time, memory footprint,
security info, form details and more. It's added automatically to any page
that has a valid HTML structure…
KnpMarkdownBundle & Service
…go... Twig is using htmlentities to output escape the text. Twig
does that automatically for security: it protects against XSS attacks - that's when
users try to enter JavaScript inside a question so that it will render & execute
on your site. In this case, we…
Validation Auto-Mapping
…that
would awesome. This is probably even better: let's chat about password
hashing algorithms. Trust me, it's actually pretty neat stuff. Specifically,
I want to talk about safely upgrading hashed passwords in your database to stay
up-to-date with security best-practices.
Flex, Versioning & extra.symfony.require
…code. Flex
has no effect on these: they upgrade normally, and that's fine.
So upgrading the "patch" version of Symfony to get bug fixes and security releases
is just as simple as running composer update "symfony/*". But to upgrade to the
next minor version…
The ObjectStateMatcher
…inside Enclosure. Remove all this complicated stuff and, at the end, just say:
|| $dinosaur->hasSameDietAs($this->dinosaurs[0]).
Run phpspec one more time:
Got it! Next, let's talk a bit more about testing exceptions and finally add
some Security to our dino park.
Flex Extras
…old!
Let's try one of these commands!
./bin/console make:voter
Call it RandomAccessVoter: we'll create a voter that randomly gives us access.
Fun! Open the new class in src/Security/Voter. This comes pre-generated with
real-world example code. In supports()…
Load Balancer & Reverse Proxy Setup
…needs to be smart enough to read these headers, instead
of the normal ones. Symfony doesn't do this automatically, because it could be a
security risk. You need to configure it explicitly.
Google for "Symfony reverse proxy". Ok! In our front controller - so app…
Composer & Cache Permissions
…to directory, mode to 0777 and recurse: true:
On deploy, this will make sure that the directory exists and is set to 777. That's not
the best option for security... but it should get things working!
Deploy one more time:
Type beefpass, deploy to…
Deploying Keys & Private Repos
… Why did I do this? Mostly, simplicity! Thanks
to this, the private key will always exist.
How bad of a security issue is this? Well, this key only gives you read-only access
to the repository. And, if you were already able to download the…
Hot Module Replacement
…Origin set to *:
Since our site is served on a different host than our assets... well really a different
port... CORS security will prevent some requests from working. This header will
allow those requests to be made.
Phew! Restart the dev server one more time…
How Symfony Builds the Container
…imports config.yml:
And config.yml loads parameters.yml, security.yml and services.yml.
Every file in the app/config directory - except the routing files - are
being loaded by the container in order to provide services. In other words,
all of these files have the…
|
security: |
|
|
// ... lines 2 - 13
|
|
firewalls: |
|
|
// ... lines 15 - 18
|
|
main: |
|
|
// ... lines 20 - 30
|
|
remember_me: ~ |
|
|
// ... lines 32 - 54
|
See Code Block in Script
|
security: |
|
|
// ... lines 2 - 20
|
|
firewalls: |
|
|
// ... lines 22 - 24
|
|
main: |
|
|
// ... lines 26 - 27
|
|
custom_authenticator: |
|
- App\Security\LoginFormAuthenticator |
|
|
// ... lines 30 - 63
|
See Code Block in Script
|
security: |
|
|
// ... lines 2 - 11
|
|
firewalls: |
|
|
// ... lines 13 - 15
|
|
main: |
|
|
// ... lines 17 - 24
|
|
access_token: |
|
|
// ... lines 26 - 52
|
See Code Block in Script
x
1000+