There are two big parts to security in any app. First, how does your user authenticate? How do they log in? Honestly, that is the trickiest part... and it has really nothing to do with API Platform. We're authenticating via the json_login authenticator…

The really neat thing about Symfony's security system is that it doesn't care at all about what your User class looks like. As long as it implements UserInterface, so, as long as it has these methods, you can do anything you want with…

I like using access control in security.yaml to help me protect entire sections of my site... like everything under /admin requires some role: But most of the time, I protect my site on a controller-by-controller basis. Open QuestionController and find the new…

…And then: Does this app need to hash or check user passwords? We'll talk more about this in the security tutorial. But if users will need to log in to your site via a password and your app will be responsible for checking to…

We've gotta talk about one more thing: security. Specifically, CSRF attacks. Imagine if a malicious person built an HTML form on a totally different site, but set its action="" attribute to a URL on our site. Then, what if some user, like me, who…

There's really only 2 things you can do with security: Deny access Find out who is logged in To show that off, find newAction(). Let's update the flash message to include the email address of the current user. Surround the string with sprintf…

Here's the million-dollar question when it comes to security and APIs: does my site need some sort of API token authentication? There's a pretty good chance that the answer is no. Even if your app has some API endpoints - like ours - if…

…big list of which recipes have been installed. So, who created the other file? Open it up: config/packages/security_checker.yaml. Each package you install may have a Flex "recipe". The idea is beautifully simple. Instead of telling people to install a package and…

…IDE, and follow the README to get set up. Run: symfony serve -d ...to get the app up and running. Here's our Starshop. If you followed the Security basics course, you're used to this: we have a registration link, a login link, and…

…turn the oven off... probably. It gives you a lot of free features that we will build by hand. But FOSUserBundle does not give you any special "security" system - it's much less interesting than that, in a good way! The bundle gives you just…

Using a shortcut Base Controller Class¶ Getting the security.context service requires too much typing. So let’s make some improvements so we can get things done faster. Create a new class called Controller inside the EventBundle and make this class extend Symfony’s standard…

Head back over to /register. We built this in our security tutorial. It does work... but we kind of cheated. Back in your editor, open src/Controller/SecurityController.php and find the register() method. Yep, it's pretty obvious: we did not use the form…

…getReferenceRepository() and assign this to a new $fixtures variable: Here's the deal: if you look in the fixtures, you can see that the first two Enclosures do not have any security. You can also see that we're using some sort of "reference" system…

Authentication is done. So how about we tackle the second half of security: authorization. This is all about figuring out whether or not the user has access to do something. For example, right now we have a fancy admin section, but probably not everyone should…

…little evil. Finally, in eraseCredentials(), add $this->plainPassword = null: Symfony calls this after logging in, and it's just a minor security measure to prevent the plain-text password from being accidentally saved anywhere. The User object is perfect. Let's add the listener.

Switching Users / Impersonation¶ What’s that ROLE_ALLOWED_TO_SWITCH all about in security.yml. Symfony gives you the ability to actually change the user you’re logged in as. Ever have a client complaint you couldn’t replicate? Well now you can login as…

…do a quick review of how our authenticator works. After activating it in security.yaml: Symfony calls our supports() method on every request before the controller: Since our authenticator knows how to handle the login form submit, we return true if the current request is…

Ok, did you figure out our problem? It's actually a pretty big security issue. Check this out. We're logged in as Picard and we're editing the Enterprise - that's our ship, so that's fine. But watch this: change the ID in…

…happened while we were upgrading recipes. In framework.yaml, it's the annotations: false. SensioFrameworkExtraBundle gave us all kinds of features like the @Route annotation, security annotation, and something called the param converter. These all relied on the annotation system, which has been replaced by…

In DragonTreasure, find the $isPublished field. Earlier we added this ApiProperty security thing so that the field is only returned for admin users or owners of this treasure. This is a simple and 100% valid way to handle this situation. However, there is another way…