Kevin Bond

Super excited about this new Symfony 8.2 feature! Controller attributes like `#[IsCsrfTokenValid]` and `#[RateLimit]` can now pass failures to your controller instead of throwing exceptions. Convenient attributes AND user-friendly feedback! github.com/symfony/symf...

🔐 Symfony Security: Going Further #13 Login is throttled, but how do we stop a bot from registering 1000's of accounts? Let's configure a rate limiter by hand and put a hard cap on how often someone can sign up! 🚦 symfonycasts.com/screencast/s...

🔐 Symfony Security: Going Further #12 Want stronger passwords - and a way to reject any that have already leaked in a data breach? Symfony ships a constraint for each, and we'll bundle them into one reusable constraint of our own! symfonycasts.com/screencast/s...

🔐 Symfony Security: Going Further #11 Need a change password form? Let's reuse the one the reset password maker already wrote for us, then ask for the current password too - with a very cool built-in constraint! symfonycasts.com/screencast/s...

🔐 Symfony Security: Going Further #10 Need a forgot password flow? There's a maker for that! Let's generate the whole thing, log the user in automatically after a reset, and see how it avoids leaking who has an account! symfonycasts.com/screencast/s...

🔐 Symfony Security: Going Further #9 Let's swap the built-in switch_user role for a custom attribute, let a voter make the call, & see how to check the permissions of any user - not just the one logged in. And, now our admins can't impersonate each other! symfonycasts.com/screencast/s...

🚀 New in Symfony 8.2: Single-Use and Safer Signed URLs ➡️ https://symfony.com/blog/new-in-symfony-8-2-single-use-and-safer-signed-urls

🔐 Symfony Security: Going Further #8 Let's give users the choice to log in with their email or username! We'll add unique usernames, update our login form, and teach Symfony how to find users by either one. symfonycasts.com/screencast/s...

🔐 Symfony Security: Going Further #7 After logging in, users should return to the page they were on, not the homepage! Let's use Symfony's _target_path to send them right back where they left off, making the login experience a little smoother! symfonycasts.com/screencast/s...

🔐 Symfony Security: Going Further #6 Need a super admin who can do (almost) anything? Let's build a custom voter that grants sweeping permissions across our app, while making sure important authentication checks still behave normally! symfonycasts.com/screencast/s...

🔐 Symfony Security: Going Further #5 Ever notice how GitHub asks you to confirm your password before sensitive actions? Let's build that same "sudo mode" in Symfony, requiring full authentication with a smooth password confirmation flow! symfonycasts.com/screencast/s...

🔐 Symfony Security: Going Further #4 Wrong password, unknown email, disabled account... your login form answers all three with "Invalid credentials." That's deliberate. Let's decide how much we actually want to give away. symfonycasts.com/screencast/s...

Symfony Cache Contracts have a sneaky little trick 👀 Use `beta: INF` to force-refresh a cached value without deleting the old one first - so other requests can keep using it while the fresh value is computed. See how it works 👇 symfonycasts.com/blog/symfony...

🔐 Symfony Security: Going Further #3 Disabling an account blocks the next login... but a user already browsing doesn't even notice. Let's show them the door mid-click. 👋 symfonycasts.com/screencast/s...

🔐 Symfony Security: Going Further #2 Deleting a user is forever. Sometimes you just want to switch them off. Let's teach our login to check more than the password. symfonycasts.com/screencast/s...

🚀 New on the blog: our ideal GitHub Actions setup for Symfony apps! Tests, linting, PHPStan, code style, database/schema checks, Symfony-aware diagnostics, asset compilation, plus a scheduled Composer security audit. A solid CI baseline you can actually build from: symfonycasts.com/blog/ideal-g...

🚨 New Course 🚨 🔐 Symfony Security: Going Further #1 A 403 status code tells us we don't have access... but it also tells us the thing exists. Let's borrow the trick GitHub uses on private repositories 🖖 symfonycasts.com/screencast/s...

🔐 Symfony Security Basics #19 Let's finish by building a complete user registration flow! We'll generate the registration form, add validation, save our new user, log them in automatically, and finish with a discussion about user enumeration. symfonycasts.com/screencast/s...

🔐 Symfony Security Basics #18 Symfony dispatches events throughout the security process. Let's explore some of the most useful ones, then put one to work tracking each user's last login! symfonycasts.com/screencast/s...

🔐 Symfony Security Basics #17 Let's protect our login form from brute-force attacks! We'll enable Symfony's login throttling, see what happens when we trip the limiter, then dig into its configuration and how it works. Delightful nerdery!

Few weeks ago, I finally released "zenstruck/foundry-behat" don't hesitate to try it and give some feedback! symfony.com/bundles/Zens... @zenstruck.com #PHP #symfony

🔐 Symfony Security Basics #16 User impersonation is super useful... until you forget you're impersonating someone! Let's make it painfully obvious when we're switched to another user and add an easy way to exit.

🔐 Symfony Security Basics #15 Need to debug a problem from a user's perspective? Let's enable Symfony's user impersonation feature so admins can temporarily switch to another user without ever knowing their password.

🔐 Symfony Security Basics #14 Hiding an action a user can't access is good UX, but it's not security! Let's enforce our voter permissions in the controller, then give admins the power to bypass them.

Doctrine lazy objects used to rely on generated proxy classes that extended your entities. PHP 8.4 makes them native. Same lazy-loading magic - fewer workarounds - and your entities can finally be "final". 🎉 See how lazy objects work 👉 youtu.be/X0HhrOnkGlc

🔐 Symfony Security Basics #13 Roles are great, but sometimes permissions need to be more precise. Let's create a custom voter to decide whether the current user can edit or delete a specific object.

One of Symfony's * coolest * security features: 1) Users log in 2) Symfony checks their password hash. 3) Old algorithm? Rehash and save automatically 🔐 Automatic security upgrades over time! youtu.be/Bu8ZDbXAsq8

"Remember Me" is convenient. It's also the reason many websites ask you to re-enter your password before changing your email address, password, or other sensitive settings. There's a good security reason for that 🔐 youtu.be/j2s_xZgYNss

🔐 Symfony Security Basics #12 Fetching the current user is easy. Fetching it elegantly is even better. Let's compare a few approaches and finish with the expressive #[CurrentUser] attribute.

A cautionary tale for web developers: If a request changes state, it should never be a GET. Browsers, crawlers, and link previewers are allowed to make GET requests automatically. The garage door story is worth hearing... 😅 youtu.be/A4ujMeiG_v8

🔐 Symfony Security Basics #11 Our User class is a Doctrine entity, which means it can have normal Doctrine relationships. Let's add one and use it to personalize our application.

TailwindBundle 1.0 is here! :tada: Add Tailwind CSS to your Symfony + AssetMapper app, with no Node required. A huge thank you to everyone who contributed, reported issues, and helped us reach 1.0! Check out the release: github.com/SymfonyCasts...

🔐 Symfony Security Basics #10 Why assign users five roles when one will do? Let's use Symfony's role hierarchy to inherit permissions, then secure an entire admin section with `access_control`.

🔐 Symfony Security Basics #9 Let's compare a few different ways to protect a page with a custom user role. Then we'll follow the login flow to access it and fix a sneaky Turbo gotcha along the way!

🔐 Symfony Security Basics #8 A remembered login isn't the same as a fresh login. Let's explore Symfony's authentication attributes and see how they can help protect sensitive actions.

Let's take a tour through the internals of Brontie, our AI assistant, we'll take a peek into how it actually works inside SymfonyCasts! 🦕 🤖 symfonycasts.com/blog/brontie...

Me: "Which password hashing algorithm should I choose?" Symfony: "Don't worry, I've got this." 🔐 ✨ youtu.be/dizl8aIqhCo

🔐 Symfony Security Basics #7 We're using session-based authentication, so let's take a peek behind the curtain to see how it works. Then we'll enable Symfony's "Remember Me" feature so users don't need to log in every time they reopen their browser.

Encryption is a locked box 🔐 Hashing is a fingerprint 👆 One is designed to be opened later. The other is designed to never reveal the original value. -- A poem from the SymfonyCasts team youtu.be/XqFviPUn3UY

🔐 Symfony Security Basics #6 Let’s see why using a simple link for logout is a bad idea. We’ll look at the reason GET requests should never change application state, then secure our logout flow with POST and CSRF protection.

Upgrading to Symfony 8 #6 (Bonus) AI is changing security research, and that means more vulnerabilities are being found and fixed than ever before. Let's explore "composer audit", CVEs, and how to automate dependency security checks.

🔐 Symfony Security Basics #5 Time to improve our user experience! We'll detect whether someone is logged in, show the appropriate login/logout links, and learn a handy trick for generating logout URLs. symfonycasts.com/screencast/s...

🔐 Symfony Security Basics #4 Hashing and encryption are very different things. We'll compare them, & see how Symfony automatically chooses the best password hashing algorithm and transparently upgrades your users as better algorithms become available.

I've been thinking about this for years. Most Symfony best practices encourage code that's explicit and hard to misuse. Doctrine entities have always felt like a strange exception. There are reasons we do it this way... but I think ObjectMapper changes the equation.

🔐 Symfony Security Basics #3 Time to log in! We'll generate a login form with MakerBundle, see how Symfony's built-in form authenticator works, explore the generated code, and take a peek at the CSRF protection that's keeping us safe.

Need clarification on a SymfonyCasts lesson without waiting for a reply? Meet Brontie 🦕, our new AI companion that understands the course and chapter you're currently watching. Read more about Brontie and why we built it: symfonycasts.com/blog/brontie...

🔐 Symfony Security Basics #2 In order for users to log in, we need a user object and a user provider. Let’s build the most common implementation: a database-backed user/provider + a user factory to quickly spin them up in our dev & test environments.