Thanks to part 1 & part 2, we've already built a seriously powerful API, complete with security, custom fields and many more goodies. In this course, we'll take things even further: State Providers & "proper" custom fields Run custom code on a "state" change (e…

When we need to deny access to something, we can do it in a couple of different places, like access_control in security.yaml: Or various ways inside of a controller. And when we deny access, we know that we can do it by checking…

If your login system looks similar to the traditional email & password or username & password setup, Symfony has a nice, built-in authentication mechanism to help. In config/packages/security.yaml, under the main firewall, add a new key: json_login. Below that, set check_path…

There's one last teeny, tiny little detail we need to worry about with webhooks: replay attacks. These are a security concern but also a practical one. We already know that nobody can send us, random, fake event data because we fetch a fresh event…

…it's from security! Open that up: Shift+Shift, ContextListener.php. Scroll down to find the method we care about: onKernelResponse(). It says: Writes the security token into the session. If you use a "stateful" firewall... which you probably are, unless your security system is…

…securities, an exception should be thrown. And of course, we will need to update some of our examples from earlier once we get this working so that they also have some active security. Anyways, down in addDinosaur(), let's call another new method if (!$this…

…probably work! However, I tend to view things like this: security is best when you're trying to completely prevent access to an operation. Validation is best when the restrictions you need to apply are based on the data that's being sent, like preventing…

There are two main places where you can deny access. The first we just learned about: access_control in security.yaml: It's simple - just a regular expression and a role. It's the best way to protect entire areas of your site - like everything…

…after registering. But... it's not as awesome as it could be. Let me show you why. First, look at my app/config/security.yml file. In order to access any URL that start with /admin, you need to be logged in. For example, if…

Question: if config.yml is so important - then what the heck is the point of all of these other files - like config_dev.yml, config_test.yml, parameters.yml, security.yml and services.yml. What is their purpose? The answer is environments. Now, I don…

…Guard - no matter what crazy authentication system you have - the first step is always to create an authenticator class. Create a new directory called Security and inside, a new class: how about LoginFormAuthenticator: The only rule about an authenticator is that it needs to extend…

…The process is easy: we'll walk through each method and just fill in the logic. But if you want to know more - check out the Symfony security course. First: getCredentials(). Our job is to read the Authorization header and return the token - if any…

… We have this great system where users are actually being authenticated! Now we can start checking for security everywhere we need it. In newAction we’re requiring that you are logged in: // src/KnpU/CodeBattle/Controller/Api/ProgrammerController.php // ... public function newAction(Request $request) { } Awesome…

…Auto-Completion¶ With the base Controller, we can give ourselves shortcuts to develop faster and faster. Inside RegisterController, my IDE recognizes the setToken method on the security context automatically. Actually, this only works because I’m using an awesome Symfony2 plugin for PHPStorm. The getSecurityContext…

…s prod environment, we’ll be able to customize how this looks. We’ll cover how to customize error pages in the next episode. The access_control section of security.yml is the easiest way to control access, but also the least flexible. Change the…

…route called event, which is our event list page. Use that for target: # app/config/security.yml # ... firewalls: To make the logout route, let’s add another method inside SecurityController and use the @Route annotation: // ... // src/Yoda/UserBundle/Controller/SecurityController.php /** @Route("/logout", name="logout…

…actual login form? Well, that’s our job - the security layer just helps us by redirecting the user here. Oh, and there’s a really popular open source bundle called FosUserBundle that gives you a lot of what we’re about to build. The good…

…with authentication and make it possible to login, let’s try out our first piece of authorization and start denying access! Head back to security.yml. The easiest way to deny access is via the access_control section. Let’s use its regular expression coolness…

…because that writes everything into the public/uploads/ directory. If we need to check security before letting a user download a file, then it can't live in the public/ directory. And that means we need a second Flysystem filesystem: one that can store things…

…obvious if you put something in the wrong spot. Press Shift+Shift and search for a file that's closely related to our new feature: TargetPathTrait. Ok, this lives in the Security component. I'll double click on the directory to move there. At first…