Security advanced

Remember-me

Remember me keeps users logged in across browser restarts with a long lived cookie. It is config text, not code in controllers.

Keep the lifetime short and refresh it on real logins. Treat the cookie like a spare key, not a master key.

2FA concept

Two factor adds a second proof after the password, often a short code from a phone app. The password alone stops working for attackers.

Ask for the code on login and on sensitive actions. Offer backup codes for lost phones.

Reuse voters

Reuse the voters from the security lesson for row level rules. One voter answers who may edit or view each object.

The sketch below grants one action by name. Real voters also check owners and roles.

use Symfony\Component\Security\Core\Authorization\Voter\Voter; class PostVoter extends Voter { protected function supports(string $attribute, mixed $subject): bool { return $attribute === "EDIT"; } protected function voteOnAttribute(string $attribute, mixed $subject, TokenInterface $token): bool { // owner wins return true; } }

Log security events

Log who did what on guarded actions: logins, failed tries, grants, and denies. Logs turn strange spikes into clear stories.

Write one line per event with who, what, and when. Read the log first when a user reports a block.

function auditLogin($log, string $who): void { $log->info("Login ok for " . $who); }

Next: HTTP client

Article author: Arthur Isaev