How Symfony 7 serves frontend assets with Asset Mapper, so CSS/JavaScript/images in assets/ can be referenced publicly with automatic cache-busting versioned URLs instead of being manually copied…

Builds a dedicated StarshipController::show() page for displaying one ship, fetches the ship by route {id} via StarshipRepository, handles missing ships with a 404, and links to the page using…

Builds a more realistic API endpoint for fetching a single starship by ID using route wildcards, route requirements, HTTP method restrictions, route prefixes, repository lookup, and a 404 when the…

Symfony's Cache Contracts have a mysterious third argument: "$beta". Here's where its name comes from, how it prevents cache stampedes, and how "beta: INF" lets you force a cache item to refresh…

Moves Starship data-fetching logic out of controllers into a reusable StarshipRepository service, then uses constructor autowiring, Twig object/property access, and |length to reuse that data on…

A practical, modern GitHub Actions setup for Symfony apps, covering tests, linting, static analysis, database checks, Symfony-aware diagnostics, and scheduled dependency security audits.

Symfony services are the objects that perform work in an app, and this chapter shows how the service container, bundles, and autowiring let controllers access built-in services like logging without…

Builds a basic JSON API endpoint in Symfony 7, first by returning an array as JSON from a controller and then by switching to Starship objects so the chapter can introduce Symfony’s Serializer…

One of Symfony's nicest login features: if you try to visit a page that requires authentication, you're automatically redirected to the login page. After you log in successfully, Symfony sends you right back to the page you originally requested. Unless... Turbo gets in the way. In this case, Turbo intercepts the login form submission and prevents the expected redirect to the protected page. The fix? Disable Turbo for the login form. Watch the full SymfonyCasts lesson: 👉 https://symfonycasts.com/screencast/symfony8-security/roles

Installs Symfony’s debugging stack with the debug pack, then uses the Web Debug Toolbar, the Profiler, and bin/console debug commands to inspect routes, Twig, logs, and request performance.

Real browser. Real JavaScript

Uses Twig template inheritance so a page template can plug its content into a shared base.html

Uses Twig in Symfony 7 to move HTML out of controllers, render templates with data, and understand Twig’s core syntax so controllers still return Response objects.

Symfony Flex is a Composer plugin that makes symfony new start from a tiny skeleton and then expands the project by applying package recipes; this chapter shows how aliases and recipes automatically…

Builds Symfony’s first real page by wiring a route to a controller method and returning an HttpFoundation\Response, establishing the core “route + controller = page” pattern.

Real browser. Real JavaScript

Enables Symfony login throttling to limit failed login attempts, explains the required RateLimiter dependency and cache-backed storage, and shows how the default per-IP/per-username and global IP limits...

Adds a visible production indicator for Symfony user impersonation and provides a dedicated way to exit impersonation, including redirecting back to the admin user list afterward.

Introduces the tiny Symfony 7 project structure, how dependencies are installed via Composer and vendor/, and how to prepare PhpStorm with the Symfony plugin before writing any code.

Impersonation with switch_user lets an admin temporarily log in as another user, and this chapter shows how to enable it in Symfony security, expose switch links in a user admin CRUD, and route the impersonated...

Sets up a fresh Symfony 7 project from scratch using the Symfony CLI, verifies local system requirements, and starts the built-in development web server so the new app can be opened in a browser.

Introduces Symfony voters as the mechanism for denying or allowing access based on custom authorization logic beyond simple roles.

Doctrine uses lazy objects to avoid loading related entities until you actually need their data. Previously, Doctrine generated special proxy classes that extended your entities. With PHP 8.4 and DoctrineBundle 3, PHP can handle lazy objects natively - no generated proxy classes required. The practical payoff? Your relationships still load only when accessed, but your entities can finally be marked as final. Watch the full SymfonyCasts course 👉 https://symfonycasts.com/screencast/symfony8-upgrade/doctrine

Introduces the idea of creating a custom Symfony security voter to make authorization decisions beyond the built-in roles system.

Use a JOIN + GROUP BY + COUNT() query in Doctrine to fetch categories and each category’s fortune-cookie count in one database query instead of one query per category.

Adds support for database-specific DQL functions like RAND() so Doctrine can randomize query order, then uses that custom function to return related FortuneCookie records in random order without…

Symfony can automatically upgrade old password hashes as users log in 🔐 When a user successfully authenticates, Symfony checks whether their stored password hash uses an outdated algorithm. If it does, Symfony rehashes the submitted plain text password with the current hasher and saves the new hash. No password reset needed. No user interruption. Just stronger hashes over time. Check out the full course 👉 https://symfonycasts.com/screencast/symfony8-security

Extends the CategoryRepository::search() query so a search term like "pets love" can match categories word-by-word using IN(), instead of only matching the whole string with LIKE.

Doctrine filters let you automatically append a global SQL condition to queries for a specific entity, solving the problem of repeatedly filtering out discontinued FortuneCookie records everywhere in…

Checking "Remember Me" keeps users logged in, but that doesn't mean they're fully authenticated. A remembered user is less trustworthy than someone who just entered their password. That's why sensitive actions - like changing an email address or password - often require you to authenticate again. It's a small distinction that makes a big difference for your application's security. Watch the full SymfonyCasts lesson 👉 https://symfonycasts.com/screencast/symfony8-security/authentication-attributes

Shows three ways to fetch the currently logged-in user in Symfony—via AbstractController::getUser(), the Security service, and controller argument resolvers—and how to make the result type-safe so...

Use Doctrine Criteria to filter a relation collection so a Category can expose only “current” FortuneCookie records, hiding those marked discontinued without writing a separate controller query.

Refactors repeated CategoryRepository query logic into reusable QueryBuilder helper methods, then makes those helpers optionally create their own builder so multiple query fragments can be composed…

A cautionary tale for every web developer. Someone built a smart garage door controller with a GET endpoint that toggled the door. Sounds convenient... until a browser, crawler, or link preview decided to "help" by making the request automatically. If a request changes state, it should never be a GET. Watch the full SymfonyCasts lesson 👉 https://symfonycasts.com/screencast/symfony8-security/logout-csrf

On our app's homepage, we have the concept of "MyShip". It's intended to be the current user's starship

What's Changed Remove deprecation layer by @kbond in #130 Remind users to clear the cache after config changes by @kbond in #136 Authenticate the GitHub API call to avoid rate limiting by @Amoifr ...

Did you know roles can have children? Yep! And a parent role inherits all the child roles. This is called role hierarchy

Shows how to bypass Doctrine ORM/QueryBuilder and run raw SQL through Doctrine DBAL’s Connection when a query is too awkward to express in QueryBuilder, then fetch and hydrate the result into a…

Let's dive deeper into user roles and how they can be used to control access to different parts of your application. We have this link to our "/parts" page, which lists a bunch of Starship parts

Symfony’s special authentication attributes let you distinguish between public, remembered, and fully authenticated users, so you can protect sensitive actions more precisely than with roles alone.

Brontie is a new AI assistant for SymfonyCasts. Learn how we built it, how it works, and how you can get involved

Doctrine can hydrate a custom DTO directly from a SELECT query using NEW, so a repository can return a strongly typed object instead of an associative array for query-specific summary data.

Shows how to extend a Doctrine query to return specific scalar fields alongside aggregates, then switch from getSingleScalarResult() to getSingleResult() so the controller can receive an associative…

Symfony has a password hasher setting called auto and it's kind of magical ✨. Instead of choosing a specific hashing algorithm yourself, Symfony automatically uses the strongest supported option available. Even better, it can still verify passwords created with older algorithms, so existing users keep logging in normally while new passwords get the latest protection. One more reason to keep your Symfony version up to date 🚀 Watch the full course 👉 https://symfonycasts.com/screencast/symfony8-security