Symfony 8.2 adds security features that replace code you've likely written by hand. We'll take the app from Symfony Security: The Basics and Going Further, upgrade it to 8.2, and swap our workarounds for the new built-in tools. We'll…

Coming soon...

Here be dragons! We've built a pretty sweet API for storing dragon treasures... but we've completely neglected one minor detail: security! In this tutorial, we'll secure our API Platform-powered API in every way imaginable... and spin up a nifty test suite…

Dinosaurs, check! Enclosures, check! But... we forgot to add security to the enclosures! Ya know, like electric fences! Dang it, I knew we forgot something. The dinosaurs have been escaping their enclosure and... of course, terrorizing the guests. The investors are not going to like…

…keeps going like normal. We don’t have to worry about checking the password because Symfony still does that for us. Ok, enough about security and Doctrine! But give yourself a high-five because you just learned some of the most powerful, but difficult stuff…

…type of security! This is a big & important topic, so let's take it head-on in part 2 of our API Platform tutorial: API token security? Or tried-and-true session based login form security? CSRF protection? SameSite Cookies? Ice Cream? Security firewall setup…

…is available to us because our controller class extends from AbstractController. This base class provides us with a lot of useful methods, including security helpers. Next item, AuthenticatedVoter::IS_AUTHENTICATED_FULLY => $this->isGranted(AuthenticatedVoter::IS_AUTHENTICATED_FULLY). I'm using the constants here but…

New security quest: I want to allow only the owner of a treasure to edit it. Right now, you're allowed to edit a treasure as long as you have this role. But that means you can edit anyone's treasure. Someone keep changing my…

Our security requirements are about to get... pretty complicated. And so, instead of testing all of that manually and hoping we don't break anything, I think it's time to take a few minutes to get a nice functional testing system set up. Spin…

…be allowed to do everything. Here's the first goal: only users with ROLE_MODERATOR should be allowed to go to the Questions CRUD section. Right now, if I hover over the security part of the web debug toolbar... yup! I only have ROLE_ADMIN..…

Back to security! We need to make sure that you can only make a PUT request to update a CheeseListing if you are the owner of that CheeseListing. As a reminder, each CheeseListing is related to one User via an $owner property. Only that User…

While we're inside security.yaml, I want to talk about another really cool feature called switch_user. Imagine you're an admin user and you're trying to debug an issue that a customer saw. But, dang it! The feature works perfectly for you…

…those are terrible! We can fix those real quick: pass a variables array to first with label set to Password. For the second one: Repeat Password: Refresh. Looking good. Since the registration form has nothing to do with security, let's just finish this! Type…

…app/config/security.yml. Security - especially authentication - is all configured here. We'll look at this piece-by-piece, but there's one section that's more important than all the rest: firewalls: Your firewall is your authentication system: it's like the security desk…

To make the security system understand what it means when we check for EDIT access on a Question object, we need a custom voter. And... to help us out, we can generate this. Find your terminal and run: symfony console make:voter Let's call…

Symfony's security system comes packed with a lot of cool stuff, like remember me, impersonation and voters. Heck, it even has built in support for a "login link" authenticator - also known as "magic login links". That's where you email a link to your…

We won't talk about security in this tutorial. But even still, we do need the concept of a user... because each treasure in the database will be owned by a user... or really, by a dragon. Later, we'll use this to allow API…

…we have a user called abraca_admin@example.com with password tada. Sign in and... it's alive! Speaking of "security" and "firewalls" and other nerdery, Symfony ships with a new command to help debug and visualize your firewall. It's called, appropriately, debug:firewall…

Our new EnclosureBuilderService is building the security systems and adding them to the Enclosure, but it's not creating any dinosaurs yet. That's a boring dinosaur park! Fortunately, that should be easy! Heck, we already have a class that's really great at doing…

Let's talk about the different security errors you can get on the login page. Try to log in as picard@enterprise.space with the password enterprise - a wrong one. We get "Invalid credentials." That makes sense. Now try to log in with an email…