Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Appearance settings

Commit 32ffae0

Browse filesBrowse files
weaverryanweaverryan
committed
Overhauling the security section
1 parent 36683ac commit 32ffae0
Copy full SHA for 32ffae0

36 files changed

+1602
-3573
lines changed

‎_build/redirection_map

Copy file name to clipboardExpand all lines: _build/redirection_map
+8Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -390,3 +390,11 @@
390390
/quick_tour/the_view /quick_tour/flex_recipes
391391
/service_container/service_locators /service_container/service_subscribers_locators
392392
/templating/overriding /bundles/override
393+
/security/custom_provider /security/user_provider
394+
/security/multiple_user_providers /security/user_provider
395+
/security/custom_password_authenticator /security/guard_authentication
396+
/security/api_key_authentication /security/api_key_authentication
397+
/security/pre_authenticated /security/auth_providers
398+
/security/host_restriction /security/firewall_restriction
399+
/security/acl_advanced /security/acl
400+
/security/password_encoding /security

‎_images/security/http_basic_popup.png

Copy file name to clipboard
-38.6 KB
Binary file not shown.

‎_images/security/symfony_loggedin_wdt.png

Copy file name to clipboard
61 KB
Loading

‎best_practices/security.rst

Copy file name to clipboardExpand all lines: best_practices/security.rst
-20Lines changed: 0 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -376,26 +376,6 @@ via the even easier shortcut in a controller::
376376
// ...
377377
}
378378

379-
Learn More
380-
----------
381-
382-
The `FOSUserBundle`_, developed by the Symfony community, adds support for a
383-
database-backed user system in Symfony. It also handles common tasks like
384-
user registration and forgotten password functionality.
385-
386-
Enable the :doc:`Remember Me feature </security/remember_me>` to
387-
allow your users to stay logged in for a long period of time.
388-
389-
When providing customer support, sometimes it's necessary to access the application
390-
as some *other* user so that you can reproduce the problem. Symfony provides
391-
the ability to :doc:`impersonate users </security/impersonating_user>`.
392-
393-
If your company uses a user login method not supported by Symfony, you can
394-
develop :doc:`your own user provider </security/custom_provider>` and
395-
:doc:`your own authentication provider </security/custom_authentication_provider>`.
396-
397-
----
398-
399379
Next: :doc:`/best_practices/web-assets`
400380

401381
.. _`ParamConverter`: https://symfony.com/doc/current/bundles/SensioFrameworkExtraBundle/annotations/converters.html

‎controller/error_pages.rst

Copy file name to clipboardExpand all lines: controller/error_pages.rst
+7Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -122,6 +122,13 @@ store the HTTP status code and message respectively.
122122
for the standard HTML exception page or ``exception.json.twig`` for the JSON
123123
exception page.
124124

125+
Security & 404 Pages
126+
--------------------
127+
128+
Due to the order of how routing and security are loaded, security information will
129+
*not* be available on your 404 pages. This means that it will appear as if you're
130+
user is logged out on the 404 page (it will work while testing, but not on production).
131+
125132
.. _testing-error-pages:
126133

127134
Testing Error Pages during Development

‎doctrine.rst

Copy file name to clipboardExpand all lines: doctrine.rst
+50-2Lines changed: 50 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -226,6 +226,8 @@ This command executes all migration files that have not already been run against
226226
your database. You should run this command on production when you deploy to keep
227227
your production database up-to-date.
228228

229+
.. _doctrine-add-more-fields:
230+
229231
Migrations & Adding more Fields
230232
-------------------------------
231233

@@ -713,12 +715,58 @@ relationships.
713715

714716
For info, see :doc:`/doctrine/associations`.
715717

718+
.. _doctrine-fixtures:
719+
716720
Dummy Data Fixtures
717721
-------------------
718722

719723
Doctrine provides a library that allows you to programmatically load testing
720-
data into your project (i.e. "fixture data"). For information, see
721-
the "`DoctrineFixturesBundle`_" documentation.
724+
data into your project (i.e. "fixture data"). Install it with:
725+
726+
.. code-block:: terminal
727+
728+
$ composer require doctrine/doctrine-fixtures-bundle --dev
729+
730+
Then, use the ``make:fixtures`` command to generate an empty fixture class:
731+
732+
.. code-block:: terminal
733+
734+
$ php bin/console make:fixtures
735+
736+
The class name of the fixtures to create (e.g. AppFixtures):
737+
> ProductFixture
738+
739+
Customize the new class to load ``Product`` objects into Doctrine::
740+
741+
// src/DataFixtures/ProductFixture.php
742+
namespace App\DataFixtures;
743+
744+
use Doctrine\Bundle\FixturesBundle\Fixture;
745+
use Doctrine\Common\Persistence\ObjectManager;
746+
747+
class ProductFixture extends Fixture
748+
{
749+
public function load(ObjectManager $manager)
750+
{
751+
$product = new Product();
752+
$product->setName('Priceless widget!');
753+
$product->setPrice(14.50);
754+
$product->setDescription('Ok, I guess it *does* have a price');
755+
$manager->persist($product);
756+
757+
// add more products
758+
759+
$manager->flush();
760+
}
761+
}
762+
763+
Empty the database and reload *all* the fixture classes with:
764+
765+
.. code-block:: terminal
766+
767+
$ php bin/console doctrine:fixtures:load
768+
769+
For information, see the "`DoctrineFixturesBundle`_" documentation.
722770

723771
Learn more
724772
----------

‎doctrine/registration_form.rst

Copy file name to clipboardExpand all lines: doctrine/registration_form.rst
+8-7Lines changed: 8 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -16,13 +16,8 @@ First, make sure you have all the dependencies you need installed:
1616
1717
$ composer require symfony/orm-pack symfony/form symfony/security-bundle symfony/validator
1818
19-
.. tip::
20-
21-
The popular `FOSUserBundle`_ provides a registration form, reset password
22-
form and other user management functionality.
23-
2419
If you don't already have a ``User`` entity and a working login system,
25-
first start with :doc:`/security/entity_provider`.
20+
first start by following :doc:`/security`.
2621

2722
Your ``User`` entity will probably at least have the following fields:
2823

@@ -166,7 +161,7 @@ With some validation added, your class may look something like this::
166161
The :class:`Symfony\\Component\\Security\\Core\\User\\UserInterface` requires
167162
a few other methods and your ``security.yaml`` file needs to be configured
168163
properly to work with the ``User`` entity. For a more complete example, see
169-
the :ref:`Entity Provider <security-crete-user-entity>` article.
164+
the :doc:`Security Guide </security>`.
170165

171166
.. _registration-password-max:
172167

@@ -420,5 +415,11 @@ To do this, add a ``termsAccepted`` field to your form, but set its
420415
The :ref:`constraints <form-option-constraints>` option is also used, which allows
421416
us to add validation, even though there is no ``termsAccepted`` property on ``User``.
422417

418+
Manually Authenticating after Success
419+
-------------------------------------
420+
421+
If you're using Guard authentication, you can :ref:`automatically authenticate<guard-manual-auth>`
422+
after registration is successful.
423+
423424
.. _`CVE-2013-5750`: https://symfony.com/blog/cve-2013-5750-security-issue-in-fosuserbundle-login-form
424425
.. _`FOSUserBundle`: https://github.com/FriendsOfSymfony/FOSUserBundle

‎reference/configuration/security.rst

Copy file name to clipboardExpand all lines: reference/configuration/security.rst
+1-2Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -48,8 +48,7 @@ is set to ``true``) when they try to access a protected resource but isn't
4848
fully authenticated.
4949

5050
This path **must** be accessible by a normal, un-authenticated user, else
51-
you may create a redirect loop. For details, see
52-
":ref:`Avoid Common Pitfalls <security-common-pitfalls>`".
51+
you may create a redirect loop.
5352

5453
check_path
5554
..........

‎reference/configuration/web_profiler.rst

Copy file name to clipboardExpand all lines: reference/configuration/web_profiler.rst
+2Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,8 @@ It enables and disables the toolbar entirely. Usually you set this to ``true``
4545
in the ``dev`` and ``test`` environments and to ``false`` in the ``prod``
4646
environment.
4747

48+
.. _intercept_redirects:
49+
4850
intercept_redirects
4951
~~~~~~~~~~~~~~~~~~~
5052

0 commit comments

Comments
0 (0)
Morty Proxy This is a proxified and sanitized view of the page, visit original site.