Coming soon...

Here be dragons! We've built a pretty sweet API for storing dragon treasures... but we've completely neglected one minor detail: security! In this tutorial, we'll secure our API Platform-powered API in every way imaginable... and spin up a nifty test suite…

Dinosaurs, check! Enclosures, check! But... we forgot to add security to the enclosures! Ya know, like electric fences! Dang it, I knew we forgot something. The dinosaurs have been escaping their enclosure and... of course, terrorizing the guests. The investors are not going to like…

…keeps going like normal. We don’t have to worry about checking the password because Symfony still does that for us. Ok, enough about security and Doctrine! But give yourself a high-five because you just learned some of the most powerful, but difficult stuff…

…type of security! This is a big & important topic, so let's take it head-on in part 2 of our API Platform tutorial: API token security? Or tried-and-true session based login form security? CSRF protection? SameSite Cookies? Ice Cream? Security firewall setup…

…is available to us because our controller class extends from AbstractController. This base class provides us with a lot of useful methods, including security helpers. Next item, AuthenticatedVoter::IS_AUTHENTICATED_FULLY => $this->isGranted(AuthenticatedVoter::IS_AUTHENTICATED_FULLY). I'm using the constants here but…

New security quest: I want to allow only the owner of a treasure to edit it. Right now, you're allowed to edit a treasure as long as you have this role. But that means you can edit anyone's treasure. Someone keep changing my…

Our security requirements are about to get... pretty complicated. And so, instead of testing all of that manually and hoping we don't break anything, I think it's time to take a few minutes to get a nice functional testing system set up. Spin…

Symfony's security system comes packed with a lot of cool stuff, like remember me, impersonation and voters. Heck, it even has built in support for a "login link" authenticator - also known as "magic login links". That's where you email a link to your…

…be allowed to do everything. Here's the first goal: only users with ROLE_MODERATOR should be allowed to go to the Questions CRUD section. Right now, if I hover over the security part of the web debug toolbar... yup! I only have ROLE_ADMIN..…

To make the security system understand what it means when we check for EDIT access on a Question object, we need a custom voter. And... to help us out, we can generate this. Find your terminal and run: symfony console make:voter Let's call…

Back to security! We need to make sure that you can only make a PUT request to update a CheeseListing if you are the owner of that CheeseListing. As a reminder, each CheeseListing is related to one User via an $owner property. Only that User…

While we're inside security.yaml, I want to talk about another really cool feature called switch_user. Imagine you're an admin user and you're trying to debug an issue that a customer saw. But, dang it! The feature works perfectly for you…

…those are terrible! We can fix those real quick: pass a variables array to first with label set to Password. For the second one: Repeat Password: Refresh. Looking good. Since the registration form has nothing to do with security, let's just finish this! Type…

…app/config/security.yml. Security - especially authentication - is all configured here. We'll look at this piece-by-piece, but there's one section that's more important than all the rest: firewalls: Your firewall is your authentication system: it's like the security desk…

We won't talk about security in this tutorial. But even still, we do need the concept of a user... because each treasure in the database will be owned by a user... or really, by a dragon. Later, we'll use this to allow API…

I like using access control in security.yaml to help me protect entire sections of my site... like everything under /admin requires some role: But most of the time, I protect my site on a controller-by-controller basis. Open QuestionController and find the new…

The really neat thing about Symfony's security system is that it doesn't care at all about what your User class looks like. As long as it implements UserInterface, so, as long as it has these methods, you can do anything you want with…

Our new EnclosureBuilderService is building the security systems and adding them to the Enclosure, but it's not creating any dinosaurs yet. That's a boring dinosaur park! Fortunately, that should be easy! Heck, we already have a class that's really great at doing…

There are two big parts to security in any app. First, how does your user authenticate? How do they log in? Honestly, that is the trickiest part... and it has really nothing to do with API Platform. We're authenticating via the json_login authenticator…