Symfony's Cache Contracts have a mysterious third argument: "$beta". Here's where its name comes from, how it prevents cache stampedes, and how "beta: INF" lets you force a cache item to refresh…

A practical, modern GitHub Actions setup for Symfony apps, covering tests, linting, static analysis, database checks, Symfony-aware diagnostics, and scheduled dependency security audits.

Enables Symfony login throttling to limit failed login attempts, explains the required RateLimiter dependency and cache-backed storage, and shows how the default per-IP/per-username and global IP limits...

Official documentation of ZenstruckFoundryBundle, a bundle for Symfony applications

Adds a visible production indicator for Symfony user impersonation and provides a dedicated way to exit impersonation, including redirecting back to the admin user list afterward.

Impersonation with switch_user lets an admin temporarily log in as another user, and this chapter shows how to enable it in Symfony security, expose switch links in a user admin CRUD, and route the impersonated...

Introduces Symfony voters as the mechanism for denying or allowing access based on custom authorization logic beyond simple roles.

Doctrine uses lazy objects to avoid loading related entities until you actually need their data. Previously, Doctrine generated special proxy classes that extended your entities. With PHP 8.4 and DoctrineBundle 3, PHP can handle lazy objects natively - no generated proxy classes required. The practical payoff? Your relationships still load only when accessed, but your entities can finally be marked as final. Watch the full SymfonyCasts course 👉 https://symfonycasts.com/screencast/symfony8-upgrade/doctrine

Introduces the idea of creating a custom Symfony security voter to make authorization decisions beyond the built-in roles system.

Symfony can automatically upgrade old password hashes as users log in 🔐 When a user successfully authenticates, Symfony checks whether their stored password hash uses an outdated algorithm. If it does, Symfony rehashes the submitted plain text password with the current hasher and saves the new hash. No password reset needed. No user interruption. Just stronger hashes over time. Check out the full course 👉 https://symfonycasts.com/screencast/symfony8-security

Checking "Remember Me" keeps users logged in, but that doesn't mean they're fully authenticated. A remembered user is less trustworthy than someone who just entered their password. That's why sensitive actions - like changing an email address or password - often require you to authenticate again. It's a small distinction that makes a big difference for your application's security. Watch the full SymfonyCasts lesson 👉 https://symfonycasts.com/screencast/symfony8-security/authentication-attributes

Shows three ways to fetch the currently logged-in user in Symfony—via AbstractController::getUser(), the Security service, and controller argument resolvers—and how to make the result type-safe so...

A cautionary tale for every web developer. Someone built a smart garage door controller with a GET endpoint that toggled the door. Sounds convenient... until a browser, crawler, or link preview decided to "help" by making the request automatically. If a request changes state, it should never be a GET. Watch the full SymfonyCasts lesson 👉 https://symfonycasts.com/screencast/symfony8-security/logout-csrf

On our app's homepage, we have the concept of "MyShip". It's intended to be the current user's starship

What's Changed Remove deprecation layer by @kbond in #130 Remind users to clear the cache after config changes by @kbond in #136 Authenticate the GitHub API call to avoid rate limiting by @Amoifr ...

Did you know roles can have children? Yep! And a parent role inherits all the child roles. This is called role hierarchy

Let's dive deeper into user roles and how they can be used to control access to different parts of your application. We have this link to our "/parts" page, which lists a bunch of Starship parts

Symfony’s special authentication attributes let you distinguish between public, remembered, and fully authenticated users, so you can protect sensitive actions more precisely than with roles alone.

Brontie is a new AI assistant for SymfonyCasts. Learn how we built it, how it works, and how you can get involved

Symfony has a password hasher setting called auto and it's kind of magical ✨. Instead of choosing a specific hashing algorithm yourself, Symfony automatically uses the strongest supported option available. Even better, it can still verify passwords created with older algorithms, so existing users keep logging in normally while new passwords get the latest protection. One more reason to keep your Symfony version up to date 🚀 Watch the full course 👉 https://symfonycasts.com/screencast/symfony8-security

Enables Symfony’s “remember me” login persistence so users stay authenticated across browser sessions instead of being logged out when the session ends.

Hashing and encryption are both used in security, but they solve different problems. 🔐 Encryption is reversible. With the right key, you can get the original data back. 👆Hashing is one-way. You can verify a match, but you can't realistically reconstruct the original value. That's why passwords should be hashed, not encrypted. Watch the full course 👉 https://symfonycasts.com/screencast/symfony8-security

Protecting logout from CSRF by changing it from a GET link to a POST form and enabling Symfony’s logout CSRF protection in the security firewall.

Uses composer audit to find dependency vulnerabilities, interpret advisories/CVEs, temporarily ignore known risks in composer.json, apply fixed updates, and automate recurring security checks with GitHub...

Uses Symfony’s app.user variable and route-based login/logout links to show the current authentication state in templates and let users sign in or sign out cleanly

Ok, we left off trying to login with a valid username and password, but it didn't work... Let's take a moment to understand why. Over in the terminal, dump our user table with: """terminal symfony console...

We have our user provider configured and a user in our database. Now we need a way to log them in! There are several different ways to do this, but we'll focus on *session-based* authentication with an...

Meet Brontie - your new SymfonyCasts companion. Part dinosaur, part AI, fully obsessed with Symfony

The first thing we need to actually authenticate someone is a special *user* class. This is a class that must implement "UserInterface" provided by Symfony

Hey Friends! Welcome to the Symfony Security course! In this tutorial, we're going to explore one of the most important parts of any web application: controlling who can access your site and what they're...

YouTube video by SymfonyCasts

Symfony upgrades do not have to be stressful. Thanks to Symfony's deprecation system, you can fix future breaking changes before upgrading

In Symfony Forms, the actual HTML input, select, and button elements are called widgets. Need more control over your form layout? Use `form_widget()` to render just the field element instead of the entire `form_row()`. You can also render each part separately: - `form_label()` - `form_widget()` - `form_errors()` - `form_help()` Perfect for custom form layouts 🎨 Check out the full course 👉 https://symfonycasts.com/screencast/symfony-forms

Symfony 7.4? Check

Let's revisit deprecations as these are important to fix. As mentioned earlier, before you can safely jump to Symfony 8

We need to upgrade the doctrine-bundle... but before we do, I want to give a refresher on a really cool Doctrine feature: lazy objects. Open up "src/Entity/StarshipPart