…$id variable argument. Like before, this query has a variable part to it, so it is a security flaw. But we’re going to fix it in a few seconds: function get_pet($id) { } Understanding Function Scope¶ Now we have the query, but we don…

…of the package... and then each package can have different recipes for different versions. Our recipe lives in sensiolabs/security-checker/4.0. Every recipe has at least this manifest.json file, which describes all of the "things" it should do. This copy-from-recipe…

…of a CRUD section as a whole. In that case, instead of trying to set permissions on every action like this, you can be lazy and use normal security. For example, head to the top of QuestionCrudController. Above the class, leverage the #[IsGranted] attribute from…

…can configure this. Remember: to get this config, I ran debug:config security... which shows your current configuration, including defaults. But not all options are shown here. To see a full list, run config:dump security. Instead of showing your actual config, this shows a…

…delete that entirely. There are two ways that you can "force" the remember me system to always set a cookie even though the checkbox isn't there. The first is in security.yaml: set always_remember_me: to true: Yes, I totally just misspelled remember..…

…find the config file, copy the root key - scheb_two_factor - and paste. Awesome! We see security_tokens with UsernamePasswordToken... that's no surprise because that's what we have here. But this also shows us some default values that we have not specifically configured…

…or a year... or whatever we configure. Let's add this. The first step is to go to config/packages/security.yaml and activate the system. We do this by saying remember_me: and then, below, setting one required piece of config: secret: set to…

…is kinda cool. If a listener to kernel.request somehow already has enough information to return a response... it can do that! It's not super common, it could be used for security or a maintenance page... but hey! Let's try it ourselves! In…

…the routing layer happens! That's RouterListener. You can also see Firewall: this is where authentication takes place. Security is a complex system... so being able to see a bit about what happens inside of it is pretty cool. At some point... it calls a…

…uploaded article images? The first question to ask is: can these uploaded files be public to everyone? Or do we need to do some sort of security check before a user can view or download them? For article images, they can be public. But we…

…through PHP. If your server is configured to execute any file ending in .php through PHP, that is a huge security risk. Ok, back to butterflies and ice cream. Even after we add validation to guarantee that the uploaded file is actually an image, the…

…Here, you can see blog posts that are categorized by each version. This is a collection of blog posts about what's new in Symfony 5.1, like the new security system. And... here are posts about what's new in Symfony 5.3, or…

…files left. Open account/index.html.twig: Yep, this has a link tag to the first... and in security/login.html.twig, here's the other: Oh, and we also include login.css from register.html.twig: This is kind of a tricky situation.... because…

…use the micro instance size, and just use the default settings on the next screens. For the security group, I'm going to select a group I already created: "Web Access Testing." The important thing is to allow port 22 for SSH and ports 80…

…all of the users... though you should - ya know - use security to avoid this if it's a problem. Auto-increment IDs have another downside: when you use an auto-increment database id as the key in your API, it means that only your server…

…relations, IRIs, filtering and more. In part 2, we talked about security, logging in, adding authorization checks to operations, making it so that certain fields can be read or written only by specific users and some pretty serious work related to custom normalizers for even…

…worries, let's add the same admin "exception" that we've added to a few other places. Start with public function __construct() so we can autowire the Security service. I'll hit Alt + Enter and click "Initialized fields" to create that property and set it…

…First, it deserializes the JSON into whatever resource object we're working with - like a CheeseListing object. Second, it applies the security access controls. And third it applies our validation rules. Do you see the problem? It's subtle. If API Platform has any problems…

…to check whether or not a user has a role. But wait... when we needed to do that in our voter, we autowired a different service via the Security type-hint. Well... these are both ways to do the exact same thing: use whichever you…

…for now: the Doctrine data persister. After deserializing the data into a User object, running security checks and executing validation, API Platform finally says: It's time to save this resource! To figure out how to save the object, it loops over all of its…