…we have a user called abraca_admin@example.com with password tada. Sign in and... it's alive! Speaking of "security" and "firewalls" and other nerdery, Symfony ships with a new command to help debug and visualize your firewall. It's called, appropriately, debug:firewall…

Here's the million-dollar question when it comes to security and APIs: does my site need some sort of API token authentication? There's a pretty good chance that the answer is no. Even if your app has some API endpoints - like ours - if…

We've gotta talk about one more thing: security. Specifically, CSRF attacks. Imagine if a malicious person built an HTML form on a totally different site, but set its action="" attribute to a URL on our site. Then, what if some user, like me, who…

…And then: Does this app need to hash or check user passwords? We'll talk more about this in the security tutorial. But if users will need to log in to your site via a password and your app will be responsible for checking to…

There's really only 2 things you can do with security: Deny access Find out who is logged in To show that off, find newAction(). Let's update the flash message to include the email address of the current user. Surround the string with sprintf…

…big list of which recipes have been installed. So, who created the other file? Open it up: config/packages/security_checker.yaml. Each package you install may have a Flex "recipe". The idea is beautifully simple. Instead of telling people to install a package and…

…turn the oven off... probably. It gives you a lot of free features that we will build by hand. But FOSUserBundle does not give you any special "security" system - it's much less interesting than that, in a good way! The bundle gives you just…

Using a shortcut Base Controller Class¶ Getting the security.context service requires too much typing. So let’s make some improvements so we can get things done faster. Create a new class called Controller inside the EventBundle and make this class extend Symfony’s standard…

…do a quick review of how our authenticator works. After activating it in security.yaml: Symfony calls our supports() method on every request before the controller: Since our authenticator knows how to handle the login form submit, we return true if the current request is…

Head back over to /register. We built this in our security tutorial. It does work... but we kind of cheated. Back in your editor, open src/Controller/SecurityController.php and find the register() method. Yep, it's pretty obvious: we did not use the form…

…getReferenceRepository() and assign this to a new $fixtures variable: Here's the deal: if you look in the fixtures, you can see that the first two Enclosures do not have any security. You can also see that we're using some sort of "reference" system…

Authentication is done. So how about we tackle the second half of security: authorization. This is all about figuring out whether or not the user has access to do something. For example, right now we have a fancy admin section, but probably not everyone should…

…little evil. Finally, in eraseCredentials(), add $this->plainPassword = null: Symfony calls this after logging in, and it's just a minor security measure to prevent the plain-text password from being accidentally saved anywhere. The User object is perfect. Let's add the listener.

Switching Users / Impersonation¶ What’s that ROLE_ALLOWED_TO_SWITCH all about in security.yml. Symfony gives you the ability to actually change the user you’re logged in as. Ever have a client complaint you couldn’t replicate? Well now you can login as…

Ok, did you figure out our problem? It's actually a pretty big security issue. Check this out. We're logged in as Picard and we're editing the Enterprise - that's our ship, so that's fine. But watch this: change the ID in…

…happened while we were upgrading recipes. In framework.yaml, it's the annotations: false. SensioFrameworkExtraBundle gave us all kinds of features like the @Route annotation, security annotation, and something called the param converter. These all relied on the annotation system, which has been replaced by…

…logic. To do the owner check, we need to know who's logged in. Add a __construct() method, autowire our favorite Security class... and I'll put private in front of that, so it becomes a property: Below, set $user = $this->security->getUser(). And…

In DragonTreasure, find the $isPublished field. Earlier we added this ApiProperty security thing so that the field is only returned for admin users or owners of this treasure. This is a simple and 100% valid way to handle this situation. However, there is another way…

…authenticate - a login form, social authentication, or an API key - your security system needs some concept of a user: some class that describes the "thing" that is logged in. Yup, step 1 of authentication is to create a User class. And there's a command…

Let's add a registration form to our site. There's a funny thing about registration forms: they have basically nothing to do with security! Think about it: the point of a registration form is just to insert new users into the database. So creating…