…the cache directory. To get our site working, we're setting the entire var/ directory to 777: This includes cache/, logs/ and sessions/. This is a bummer for security. Here's my big question: after we deploy, which files truly need to be writable by…

…of the Api Platform series! In part 1, we built a fully-featured API. Then in part 2 we leveled-up by adding a robust security system, security checks and user-specific fields. So what's left? In part 3, we're taking customizations to…

Over the next hour, we're going to take you through some of the most difficult areas of Symfony learning all about security, forms, and parts of Doctrine. We'll also see testing and learn more about how Symfony's service container works. When you…

…maker-bundle provides a wizard to help! At your terminal, run: symfony console make:security:form-login We're first prompted to create a controller class for our login/logout routes. SecurityController is a good name, let's go with that! Do we want a …

…and that red border is gone. But we're still on the parts page - it didn't redirect us to the homepage. If you remember, over in config/packages/security.yaml, we configured this target_route. That does not get triggered when you're exiting…

…in Symfony - password migration! In your IDE, open config/packages/security.yaml and check out the password_hashers section. We have a single hasher configured for our PasswordAuthenticatedUserInterface users, and it's set to auto. Does this cover our custom User? Open src/Entity/User…

…application level, against someone brute forcing an account - trying every possible password combination until they get in. To enable this feature, over in your IDE, open config/packages/security.yaml. Down in our main firewall, add login_throttling: true: Now refresh the login page... and…

…recipe system. In Symfony 6, those features include new JavaScript tools and a new security system... just to name two of the many new things. Symfony is also lightning fast with a huge focus on creating a joyful developer experience, but without sacrificing programming best…

…Vue app that I built. It has a login form... but it doesn't work yet: it will be up to us to bring it to life. Now before we dive into security, one question I sometimes get is: Hey Ryan, the interactive docs are…

…celebrate. Fortunately, Symfony has the perfect system just for this! Spin over and open up config/packages/security.yaml. Anywhere under your firewall add access_token: This activates a listener that will watch every request to see if it has an Authorization header. If it…

…our API resource objects are turned into JSON and how the JSON sent by the user is turned back into those same objects. Episode 2 was about security and included things like state processors - the key to running code before or after saving - custom fields…

…but with a different set of roles? A set based on the scopes from the token? We're using the access_token security system. Hit Shift+Shift and open a core class called AccessTokenAuthenticator. This is cool: it's the actual code behind that authentication…

…right there - or by going to /api/docs.json. A few minutes ago, we added some config to API Platform called Authorization: The end result is that it added these security sections down here. Yup, it's that simple: this config triggered these new sections…

…This is all super awesome... but it sure does crank up the complexity of our API, especially when it comes to security. For example, we can no longer see unpublished treasures from the GET collection or GET single endpoints. But we can still see unpublished…

…$id variable argument. Like before, this query has a variable part to it, so it is a security flaw. But we’re going to fix it in a few seconds: function get_pet($id) { } Understanding Function Scope¶ Now we have the query, but we don…

… Override templates... at many different levels Take control of your forms Handling security Adding custom actions (and removing others) Updating and configuring the menu (like adding a link to kitten videos!) Hooking into events to do things before or after an entity is saved Adding…

…Client Credentials: making API requests for our own account Authorization Code: Getting a token for another user's account Logging in via OAuth OAuth with Facebook OAuth in JavaScript with Google+ Handling Expired Tokens Using Refresh Tokens Tightening up Security As we go through these…

…delete that entirely. There are two ways that you can "force" the remember me system to always set a cookie even though the checkbox isn't there. The first is in security.yaml: set always_remember_me: to true: Yes, I totally just misspelled remember..…

…find the config file, copy the root key - scheb_two_factor - and paste. Awesome! We see security_tokens with UsernamePasswordToken... that's no surprise because that's what we have here. But this also shows us some default values that we have not specifically configured…

…or a year... or whatever we configure. Let's add this. The first step is to go to config/packages/security.yaml and activate the system. We do this by saying remember_me: and then, below, setting one required piece of config: secret: set to…