…in Symfony - password migration! In your IDE, open config/packages/security.yaml and check out the password_hashers section. We have a single hasher configured for our PasswordAuthenticatedUserInterface users, and it's set to auto. Does this cover our custom User? Open src/Entity/User…

…maker-bundle provides a wizard to help! At your terminal, run: symfony console make:security:form-login We're first prompted to create a controller class for our login/logout routes. SecurityController is a good name, let's go with that! Do we want a …

…Vue app that I built. It has a login form... but it doesn't work yet: it will be up to us to bring it to life. Now before we dive into security, one question I sometimes get is: Hey Ryan, the interactive docs are…

…our API resource objects are turned into JSON and how the JSON sent by the user is turned back into those same objects. Episode 2 was about security and included things like state processors - the key to running code before or after saving - custom fields…

…recipe system. In Symfony 6, those features include new JavaScript tools and a new security system... just to name two of the many new things. Symfony is also lightning fast with a huge focus on creating a joyful developer experience, but without sacrificing programming best…

…celebrate. Fortunately, Symfony has the perfect system just for this! Spin over and open up config/packages/security.yaml. Anywhere under your firewall add access_token: This activates a listener that will watch every request to see if it has an Authorization header. If it…

…some users the superpower to temporarily log in as someone else. Here's how. First, we need to enable the feature. In security.yaml, under our firewall somewhere, add switch_user: true: This activates a new authenticator. So we now have our CustomAuthenticator, form_login…

…but with a different set of roles? A set based on the scopes from the token? We're using the access_token security system. Hit Shift+Shift and open a core class called AccessTokenAuthenticator. This is cool: it's the actual code behind that authentication…

…right there - or by going to /api/docs.json. A few minutes ago, we added some config to API Platform called Authorization: The end result is that it added these security sections down here. Yup, it's that simple: this config triggered these new sections…

…simple. We need to read the submitted email, query the database for that User object... and eventually check the user's password. The weird thing about Symfony's security system is that... we're not going to write this logic in the controller. Nope. When…

…bin/console commands. Run php bin/console and look for the make section. Ooh. There's a ton of stuff here for setting up security, generating doctrine entities for the database (which we'll do in the next tutorial), making a CRUD, and much more…

…Yup, we have ROLE_USER. This is too boring... so let's add some true admin users! First, open config/packages/security.yaml... and, down under access_control, change this to once again require ROLE_ADMIN: Remember: roles are just strings that we invent... they…

…At the start of every request, before Symfony calls the controller, the security system executes a set of "authenticators". The job of each authenticator is to look at the request, see if there is any authentication information that it understands - like a submitted email and…

… Override templates... at many different levels Take control of your forms Handling security Adding custom actions (and removing others) Updating and configuring the menu (like adding a link to kitten videos!) Hooking into events to do things before or after an entity is saved Adding…

…Client Credentials: making API requests for our own account Authorization Code: Getting a token for another user's account Logging in via OAuth OAuth with Facebook OAuth in JavaScript with Google+ Handling Expired Tokens Using Refresh Tokens Tightening up Security As we go through these…

…This is all super awesome... but it sure does crank up the complexity of our API, especially when it comes to security. For example, we can no longer see unpublished treasures from the GET collection or GET single endpoints. But we can still see unpublished…

…2nd argument to CustomCredentials. For us, that's the submitted password: Let's pretend that all users have the same password tada! To validate that, return true if $credentials === 'tada': Air-tight security! If we return true from this function, authentication is successful! Woo…

…log out link. Access was granted for all three of these. In addition to IS_AUTHENTICATED_FULLY, there are a couple of other special strings that you can pass into the security system. The first is IS_AUTHENTICATED_REMEMBERED, which is super powerful... but can…

…get our first look at authorization. That's the fun part where we get to run around and deny access to different parts of our site. The easiest way to kick someone out of your party is actually right inside of config/packages/security.yaml…

…since we want to really learn security, let's do this step-by-step... mostly by hand. Before we start thinking about authenticating the user, we first need to build a login page, which... if you think about it... has nothing to do with security…