…there’s no downside here - make sure you have one of these on your server. And on that note, PHP typically gets faster from version to version. So staying on the latest version is good for more than just security and features. Thanks PHPeeps! Ok…

… Login as Wayne. Remember, he has ROLE_ADMIN, which also means he has ROLE_EVENT_CREATE because of the role_hierarchy section in security.yml. Now, fill in some basic data and submit it. To see the result, use the query tool to list the…

…toolbar, and you may end up loving it even more than the console. It tells us which controller was rendered, the page load time, memory footprint, security info, form details and more. It's added automatically to any page that has a valid HTML structure…

…huge step forward. Next, let's dial in on these remaining deprecations and work on squashing them. We're going to start with the elephant in the room: converting to the new security system. But don't worry! It's easier than you might think!

…config is no config... which tells Doctrine to figure out things for us. Once again, add all these changes, commit, and... let's keep going! Well, let's keep going in the next chapter, where we upgrade DoctrineExtensionsBundle, some debug recipes, routing, security and more!

…prevent the user from logging in until they've verified their email. To do that, we first need to learn about the events that happen inside of the security system. And to show off those, we'll leverage a really cool new feature: login throttling…

…it to see if the User is logged in because this will return null if they're not. A more "official" way to do this would be to use isGranted() - that's another method on the Security class - and check for IS_AUTHENTICATED_REMEMBERED: Anyways…

…the value, open .env.local, copy the long DSN string, then paste here. You won't see the value because the command is hiding it for security purposes. And... boom! This generated the prod vault and encrypted the secret. Check out config/secrets/prod. It…

…that would awesome. This is probably even better: let's chat about password hashing algorithms. Trust me, it's actually pretty neat stuff. Specifically, I want to talk about safely upgrading hashed passwords in your database to stay up-to-date with security best-practices.

…forget to put security back: @IsGranted("MANAGE", subject="article"). In a real project, wherever I test my API endpoints - like Postman or via functional tests, I would actually authenticate myself properly so they worked, instead of temporarily hacking out security. Generally speaking, removing security is…

…more time. The huge error is replaced by a much more pleasant validation message. Next: the author can upload a file reference... but it is literally impossible for them to download it. How can we make these private files accessible, but still check security first?

…it... but I don't really see the point. I'll keep absolute URLs always. Next: let's start uploading private assets: stuff that can't be put into the public/ directory because we need to check security before we let a user download it.

…old! Let's try one of these commands! ./bin/console make:voter Call it RandomAccessVoter: we'll create a voter that randomly gives us access. Fun! Open the new class in src/Security/Voter. This comes pre-generated with real-world example code. In supports()…

…needs to be smart enough to read these headers, instead of the normal ones. Symfony doesn't do this automatically, because it could be a security risk. You need to configure it explicitly. Google for "Symfony reverse proxy". Ok! In our front controller - so app…

…to directory, mode to 0777 and recurse: true: On deploy, this will make sure that the directory exists and is set to 777. That's not the best option for security... but it should get things working! Deploy one more time: Type beefpass, deploy to…

… Why did I do this? Mostly, simplicity! Thanks to this, the private key will always exist. How bad of a security issue is this? Well, this key only gives you read-only access to the repository. And, if you were already able to download the…

…Origin set to *: Since our site is served on a different host than our assets... well really a different port... CORS security will prevent some requests from working. This header will allow those requests to be made. Phew! Restart the dev server one more time…

…using the module is pretty simple! We're just going to give it a lot of info about the image we want, the security group to use, the region and so on. Add a new task called "Create an Instance". Use the ec2 module and…

…imports config.yml: And config.yml loads parameters.yml, security.yml and services.yml. Every file in the app/config directory - except the routing files - are being loaded by the container in order to provide services. In other words, all of these files have the…