Tessera

Rewind ⏪ Doctrine Queries #10 If a query gets super complex, there's no need to force it into a query builder or DQL. Write raw SQL query and execute it through Doctrine. Let's do it! symfonycasts.com/screencast/d...

Raw SQL Queries

Shows how to bypass Doctrine ORM/QueryBuilder and run raw SQL through Doctrine DBAL’s Connection when a query is too awkward to express in QueryBuilder, then fetch and hydrate the result into a…

symfonycasts.com

🔐 Symfony Security Basics #9 Let's compare a few different ways to protect a page with a custom user role. Then we'll follow the login flow to access it and fix a sneaky Turbo gotcha along the way!

User Roles

Let's dive deeper into user roles and how they can be used to control access to different parts of your application. We have this link to our "/parts" page, which lists a bunch of Starship parts

symfonycasts.com

🔐 Symfony Security Basics #8 A remembered login isn't the same as a fresh login. Let's explore Symfony's authentication attributes and see how they can help protect sensitive actions.

Authentication Attributes

Symfony’s special authentication attributes let you distinguish between public, remembered, and fully authenticated users, so you can protect sensitive actions more precisely than with roles alone.

symfonycasts.com

Let's take a tour through the internals of Brontie, our AI assistant, we'll take a peek into how it actually works inside SymfonyCasts! 🦕 🤖 symfonycasts.com/blog/brontie...

How We Built Brontie your AI Assistant

Brontie is a new AI assistant for SymfonyCasts. Learn how we built it, how it works, and how you can get involved

symfonycasts.com

Rewind ⏪ Doctrine Queries #9 Did you know you could select fields from Doctrine and hydrate them into a "NEW MyDtoClass()" right inside your query? Let's take this lesser-known Doctrine feature for a ride! symfonycasts.com/screencast/d...

SELECTing into a New DTO Object

Doctrine can hydrate a custom DTO directly from a SELECT query using NEW, so a repository can return a strongly typed object instead of an associative array for query-specific summary data.

symfonycasts.com

Rewind ⏪ Doctrine Queries #8 Let's select more and more and more specific fields and see what kind of trouble we can get into! To fetch multiple columns in 1 row, we'll use getSingleResult(). symfonycasts.com/screencast/d...

Selecting Specific Fields

Shows how to extend a Doctrine query to return specific scalar fields alongside aggregates, then switch from getSingleScalarResult() to getSingleResult() so the controller can receive an associative…

symfonycasts.com

Me: "Which password hashing algorithm should I choose?" Symfony: "Don't worry, I've got this." 🔐 ✨ youtu.be/dizl8aIqhCo

Symfony's Smart Password Hasher

Symfony has a password hasher setting called auto and it's kind of magical ✨. Instead of choosing a specific hashing algorithm yourself, Symfony automatically uses the strongest supported option available. Even better, it can still verify passwords created with older algorithms, so existing users keep logging in normally while new passwords get the latest protection. One more reason to keep your Symfony version up to date 🚀 Watch the full course 👉 https://symfonycasts.com/screencast/symfony8-security

youtu.be

Rewind ⏪ Doctrine Queries #7 Usually we query for *full* entity objects in Doctrine. But that's not always what we need! Let's grab a SUM & use getSingleScalarResult() to fetch just *one* piece of data. symfonycasts.com/screencast/d...

SELECT the SUM (or COUNT)

Uses Doctrine aggregate functions to compute a category’s total numberPrinted across all related FortuneCookie rows in the database instead of loading every entity into PHP and summing in memory.

symfonycasts.com

SymfonyCasts @symfonycasts.com · 4w ago

🔐 Symfony Security Basics #7 We're using session-based authentication, so let's take a peek behind the curtain to see how it works. Then we'll enable Symfony's "Remember Me" feature so users don't need to log in every time they reopen their browser.

Enabling "Remember Me" Feature

Enables Symfony’s “remember me” login persistence so users stay authenticated across browser sessions instead of being logged out when the session ends.

symfonycasts.com

Rewind ⏪ Doctrine Queries #6 One of my favorite lil' features in Doctrine: fetch: EXTRA_LAZY for when you need to COUNT() a relation. It's easy... though not ALWAYS a benefit (see if you can solve the challenge!) symfonycasts.com/screencast/d...

EXTRA_LAZY Relationships

Uses Doctrine relationship fetching to avoid unnecessary full entity loading: EXTRA_LAZY for count-only collections on the homepage and a custom repository query with JOIN to eliminate a mini N+1…

symfonycasts.com

SymfonyCasts @symfonycasts.com · 4w ago

Encryption is a locked box 🔐 Hashing is a fingerprint 👆 One is designed to be opened later. The other is designed to never reveal the original value. -- A poem from the SymfonyCasts team youtu.be/XqFviPUn3UY

Hashing vs Encryption: What's the Difference?

Hashing and encryption are both used in security, but they solve different problems. 🔐 Encryption is reversible. With the right key, you can get the original data back. 👆Hashing is one-way. You can verify a match, but you can't realistically reconstruct the original value. That's why passwords should be hashed, not encrypted. Watch the full course 👉 https://symfonycasts.com/screencast/symfony8-security

youtu.be

SymfonyCasts @symfonycasts.com · 4w ago

🔐 Symfony Security Basics #6 Let’s see why using a simple link for logout is a bad idea. We’ll look at the reason GET requests should never change application state, then secure our logout flow with POST and CSRF protection.

Protecting Logout with CSRF

Protecting logout from CSRF by changing it from a GET link to a POST form and enabling Symfony’s logout CSRF protection in the security firewall.

symfonycasts.com

Rewind ⏪ Doctrine Queries #5 JOINing via a relationship in Doctrine will *not*, automatically reduce queries. Let's fix the N+1 problem with 1 line + learn why we can select from multiple entities... without changing what Doctrine *directly* gives us back. symfonycasts.com/screencast/d...

JOINs and addSelect Reduce Queries

Doctrine lazy-loads Category → FortuneCookie relations in Twig, causing an N+1 query problem on the homepage, and the chapter shows how JOIN plus addSelect() preloads related rows to collapse those…

symfonycasts.com

Rewind ⏪ Doctrine Queries #4 Joining across tables is just... more fun in Doctrine vs SQL. Let's see how *little* info we need to add to our query to JOIN then filter based on the joined table. symfonycasts.com/screencast/d...

JOINs

Use a Doctrine JOIN across a OneToMany relation in a repository query so a Category search can match not only name and iconKey, but also text stored in related FortuneCookie records, and recognize…

symfonycasts.com

Rewind ⏪ Doctrine Queries #3 Doctrine's QueryBuilder has ->where(), ->andWhere() and ->orWhere() methods. But... I don't think I've ever used 2 of those. Let's find out why. symfonycasts.com/screencast/d...

andWhere() and orWhere()

Builds a searchable Category listing by reading the q query parameter, adding a Doctrine repository search method, and using andWhere() correctly for fuzzy matching and safe OR logic.

symfonycasts.com

Upgrading to Symfony 8 #6 (Bonus) AI is changing security research, and that means more vulnerabilities are being found and fixed than ever before. Let's explore "composer audit", CVEs, and how to automate dependency security checks.

Composer Audit and Security Updates

Uses composer audit to find dependency vulnerabilities, interpret advisories/CVEs, temporarily ignore known risks in composer.json, apply fixed updates, and automate recurring security checks with GitHub...

symfonycasts.com

🔐 Symfony Security Basics #5 Time to improve our user experience! We'll detect whether someone is logged in, show the appropriate login/logout links, and learn a handy trick for generating logout URLs. symfonycasts.com/screencast/s...

app.user and Login/Logout Links

Uses Symfony’s app.user variable and route-based login/logout links to show the current authentication state in templates and let users sign in or sign out cleanly

symfonycasts.com

Rewind ⏪ Doctrine Queries #2 Writing raw DQL to see how things work behind-the-scenes is pretty fun. But, in the real world, we use Doctrine's QueryBuilder... though its entire job - as we'll see! - is *still* to write that DQL string. symfonycasts.com/screencast/d...

The QueryBuilder

It's really powerful to understand that DQL is *ultimately* what's being used behind the scenes in Doctrine. But most of the time, we're not going to build this DQL string by hand

symfonycasts.com

SymfonyCasts Snippets: Authentication: "I'm Captain Kirk." Authorization: "Cool. But are you allowed on the bridge?" 🖖 youtu.be/qWXFCWjFxk0

Authentication vs Authorization

Authentication and authorization are often confused, but they answer two very different questions: 🔐 Authentication: Who are you? 🛡️ Authorization: What are you allowed to do? Logging in proves your identity. Authorization determines what pages, features, and actions you can access after that. Understanding the difference is the foundation of application security. Catch the full course here 👉 https://symfonycasts.com/screencast/symfony8-security

youtu.be

🔐 Symfony Security Basics #4 Hashing and encryption are very different things. We'll compare them, & see how Symfony automatically chooses the best password hashing algorithm and transparently upgrades your users as better algorithms become available.

Understanding Password Hashing

Ok, we left off trying to login with a valid username and password, but it didn't work... Let's take a moment to understand why. Over in the terminal, dump our user table with: """terminal symfony console...

symfonycasts.com