…right there - or by going to /api/docs.json. A few minutes ago, we added some config to API Platform called Authorization: The end result is that it added these security sections down here. Yup, it's that simple: this config triggered these new sections…

…Here, you can see blog posts that are categorized by each version. This is a collection of blog posts about what's new in Symfony 5.1, like the new security system. And... here are posts about what's new in Symfony 5.3, or…

…First, it deserializes the JSON into whatever resource object we're working with - like a CheeseListing object. Second, it applies the security access controls. And third it applies our validation rules. Do you see the problem? It's subtle. If API Platform has any problems…

…see that we're currently logged in. And now... gone! We are anonymous. Before we keep going with all this API & security goodness, our app has a bug. If we log in... as soon as the AJAX call finishes, we've made our Vue.js…

…that can be used to activate development settings locally. But first, we need to play with permissions: Drupal makes some files in this directory readonly for security. Start by making sites/default writable by us: Now, copy sites/example.settings.local.php to sites/default…

…s get to work. Over the next hour, we’re going to take things to the next level, aiming at some of the most difficult areas of Symfony, like security, forms, and some serious Doctrine topics. Some of this stuff will look pretty tough at…

…bin/console commands. Run php bin/console and look for the make section. Ooh. There's a ton of stuff here for setting up security, generating doctrine entities for the database (which we'll do in the next tutorial), making a CRUD, and much more…

…find the config file, copy the root key - scheb_two_factor - and paste. Awesome! We see security_tokens with UsernamePasswordToken... that's no surprise because that's what we have here. But this also shows us some default values that we have not specifically configured…

…simple. We need to read the submitted email, query the database for that User object... and eventually check the user's password. The weird thing about Symfony's security system is that... we're not going to write this logic in the controller. Nope. When…

…is kinda cool. If a listener to kernel.request somehow already has enough information to return a response... it can do that! It's not super common, it could be used for security or a maintenance page... but hey! Let's try it ourselves! In…

…files left. Open account/index.html.twig: Yep, this has a link tag to the first... and in security/login.html.twig, here's the other: Oh, and we also include login.css from register.html.twig: This is kind of a tricky situation.... because…

…vendor/bin/phpspec run Booya! New plan time team! Let's add a method to the service where we can pass it the number of dinosaurs we want, how much security we want, and... it will take care of the rest! Let's examplify that…

… Perfect. Log in as picard@enterprise.space, password makeitso. Oops - you know what we forgot? We have to update the template. Over in templates/security/change_password.html.twig, clear out the body. For now, render the form with {{ form(form) }}: Refresh. Not styled yet…

…they can continue. Copy that name. You can use this with any #[IsGranted], but I want to blanket our whole admin section - everything under /admin - with this requirement. Go to config/packages/security.yaml. Down here in access_control, we already have a rule: for…

…It would be cool if we went back to the page we were on when we clicked login. Jump over to the terminal and look at the config options for our form login: symfony console config:dump security firewalls Scroll up to find form_login…

…all of the users... though you should - ya know - use security to avoid this if it's a problem. Auto-increment IDs have another downside: when you use an auto-increment database id as the key in your API, it means that only your server…

…relations, IRIs, filtering and more. In part 2, we talked about security, logging in, adding authorization checks to operations, making it so that certain fields can be read or written only by specific users and some pretty serious work related to custom normalizers for even…

…worries, let's add the same admin "exception" that we've added to a few other places. Start with public function __construct() so we can autowire the Security service. I'll hit Alt + Enter and click "Initialized fields" to create that property and set it…

…to check whether or not a user has a role. But wait... when we needed to do that in our voter, we autowired a different service via the Security type-hint. Well... these are both ways to do the exact same thing: use whichever you…

…for now: the Doctrine data persister. After deserializing the data into a User object, running security checks and executing validation, API Platform finally says: It's time to save this resource! To figure out how to save the object, it loops over all of its…