TailwindBundle 1.0 is here! :tada: Add Tailwind CSS to your Symfony + AssetMapper app, with no Node required. A huge thank you to everyone who contributed, reported issues, and helped us reach 1.0! Check out the release: github.com/SymfonyCasts...

Release v1.0.0 · SymfonyCasts/tailwind-bundle

What's Changed Remove deprecation layer by @kbond in #130 Remind users to clear the cache after config changes by @kbond in #136 Authenticate the GitHub API call to avoid rate limiting by @Amoifr ...

github.com

🔐 Symfony Security Basics #10 Why assign users five roles when one will do? Let's use Symfony's role hierarchy to inherit permissions, then secure an entire admin section with `access_control`.

Role Hierarchy & Access Control

Did you know roles can have children? Yep! And a parent role inherits all the child roles. This is called role hierarchy

symfonycasts.com

🔐 Symfony Security Basics #9 Let's compare a few different ways to protect a page with a custom user role. Then we'll follow the login flow to access it and fix a sneaky Turbo gotcha along the way!

User Roles

Let's dive deeper into user roles and how they can be used to control access to different parts of your application. We have this link to our "/parts" page, which lists a bunch of Starship parts

symfonycasts.com

🔐 Symfony Security Basics #8 A remembered login isn't the same as a fresh login. Let's explore Symfony's authentication attributes and see how they can help protect sensitive actions.

Authentication Attributes

Symfony’s special authentication attributes let you distinguish between public, remembered, and fully authenticated users, so you can protect sensitive actions more precisely than with roles alone.

symfonycasts.com

Let's take a tour through the internals of Brontie, our AI assistant, we'll take a peek into how it actually works inside SymfonyCasts! 🦕 🤖 symfonycasts.com/blog/brontie...

How We Built Brontie your AI Assistant

Brontie is a new AI assistant for SymfonyCasts. Learn how we built it, how it works, and how you can get involved

symfonycasts.com

Me: "Which password hashing algorithm should I choose?" Symfony: "Don't worry, I've got this." 🔐 ✨ youtu.be/dizl8aIqhCo

🔐 Symfony Security Basics #7 We're using session-based authentication, so let's take a peek behind the curtain to see how it works. Then we'll enable Symfony's "Remember Me" feature so users don't need to log in every time they reopen their browser.

Enabling "Remember Me" Feature

Enables Symfony’s “remember me” login persistence so users stay authenticated across browser sessions instead of being logged out when the session ends.

symfonycasts.com

Encryption is a locked box 🔐 Hashing is a fingerprint 👆 One is designed to be opened later. The other is designed to never reveal the original value. -- A poem from the SymfonyCasts team youtu.be/XqFviPUn3UY

Hashing vs Encryption: What's the Difference?

Hashing and encryption are both used in security, but they solve different problems. 🔐 Encryption is reversible. With the right key, you can get the original data back. 👆Hashing is one-way. You can verify a match, but you can't realistically reconstruct the original value. That's why passwords should be hashed, not encrypted. Watch the full course 👉 https://symfonycasts.com/screencast/symfony8-security

youtu.be

🔐 Symfony Security Basics #6 Let’s see why using a simple link for logout is a bad idea. We’ll look at the reason GET requests should never change application state, then secure our logout flow with POST and CSRF protection.

Protecting Logout with CSRF

Protecting logout from CSRF by changing it from a GET link to a POST form and enabling Symfony’s logout CSRF protection in the security firewall.

symfonycasts.com

Upgrading to Symfony 8 #6 (Bonus) AI is changing security research, and that means more vulnerabilities are being found and fixed than ever before. Let's explore "composer audit", CVEs, and how to automate dependency security checks.

Composer Audit and Security Updates

Uses composer audit to find dependency vulnerabilities, interpret advisories/CVEs, temporarily ignore known risks in composer.json, apply fixed updates, and automate recurring security checks with GitHub...

symfonycasts.com

🔐 Symfony Security Basics #5 Time to improve our user experience! We'll detect whether someone is logged in, show the appropriate login/logout links, and learn a handy trick for generating logout URLs. symfonycasts.com/screencast/s...

app.user and Login/Logout Links

Uses Symfony’s app.user variable and route-based login/logout links to show the current authentication state in templates and let users sign in or sign out cleanly

symfonycasts.com

🔐 Symfony Security Basics #4 Hashing and encryption are very different things. We'll compare them, & see how Symfony automatically chooses the best password hashing algorithm and transparently upgrades your users as better algorithms become available.

Understanding Password Hashing

Ok, we left off trying to login with a valid username and password, but it didn't work... Let's take a moment to understand why. Over in the terminal, dump our user table with: """terminal symfony console...

symfonycasts.com

I've been thinking about this for years. Most Symfony best practices encourage code that's explicit and hard to misuse. Doctrine entities have always felt like a strange exception. There are reasons we do it this way... but I think ObjectMapper changes the equation.

SymfonyCasts@symfonycasts.com · 2mo ago

🤔 Your #Doctrine entities are lying to you. Or at least... they might be. We've spent years making required properties nullable so entities can double as form models. #Symfony's new ObjectMapper component has me wondering if there's a better way. symfonycasts.com/blog/honest-...

🔐 Symfony Security Basics #3 Time to log in! We'll generate a login form with MakerBundle, see how Symfony's built-in form authenticator works, explore the generated code, and take a peek at the CSRF protection that's keeping us safe.

Creating a Login Form

We have our user provider configured and a user in our database. Now we need a way to log them in! There are several different ways to do this, but we'll focus on *session-based* authentication with an...

symfonycasts.com

Need clarification on a SymfonyCasts lesson without waiting for a reply? Meet Brontie 🦕, our new AI companion that understands the course and chapter you're currently watching. Read more about Brontie and why we built it: symfonycasts.com/blog/brontie...

Meet Brontie, your AI Companion

Meet Brontie - your new SymfonyCasts companion. Part dinosaur, part AI, fully obsessed with Symfony

symfonycasts.com

🔐 Symfony Security Basics #2 In order for users to log in, we need a user object and a user provider. Let’s build the most common implementation: a database-backed user/provider + a user factory to quickly spin them up in our dev & test environments.

Creating the User Class

The first thing we need to actually authenticate someone is a special *user* class. This is a class that must implement "UserInterface" provided by Symfony

symfonycasts.com

🚨 New course 🚨 🔐 Symfony Security Basics #1 Symfony Security is the gatekeeper of your application. We'll install the Security component, explore the default configuration, talk firewalls, & learn the difference between authentication & authorization.

Installing the Security Bundle

Hey Friends! Welcome to the Symfony Security course! In this tutorial, we're going to explore one of the most important parts of any web application: controlling who can access your site and what they're...

symfonycasts.com

Thanks, #SymfonyDay Montreal! We had a great time at the @SymfonyCasts.com booth meeting members of the community and talking #Symfony. Also pictured: future #Symfony developers?! Maybe someday they'll finally get my 10-year-old Doctrine ORM PR merged. 🙃🤪🤞

Talking to AI is a strange mix of being a tyrant-king "excellent idea, sir" and arguing with my 8-year-old "you're not listening to me!"

🇨🇦🚆🇨🇦 En route to Montreal for #SymfonyDay with our two newest @symfonycasts.com interns! #Symfony

I'm so happy "named autowiring aliases without the Target attribute" in #Symfony is being deprecated! I recently did a quick video on the dangers: www.youtube.com/watch?v=t2Cd...

The Hidden Danger of Named Autowiring

YouTube video by SymfonyCasts

youtube.com

Symfony@symfony.com · 2mo ago

🚀 New in Symfony 8.1: Dependency Injection Improvements ➡️ https://symfony.com/blog/new-in-symfony-8-1-dependency-injection-improvements

Symfony upgrades do not have to be scary 😌 Deprecations are your roadmap: Fix warnings in 7.4 → upgrade safely to Symfony 8 🚀 0 deprecations = no surprises. symfonycasts.com/blog/depreca...

Symfony Deprecations Explained (Upgrade Without Breaking Things)

Symfony upgrades do not have to be stressful. Thanks to Symfony's deprecation system, you can fix future breaking changes before upgrading

symfonycasts.com

Symfony form tip 💡 `form_row()` renders everything. `form_widget()` renders just the field itself. Need full control? Render the label, widget, errors, and help text separately 🎨 youtu.be/uRykFN4fk-s

Symfony Forms: form_row() vs form_widget()

In Symfony Forms, the actual HTML input, select, and button elements are called widgets. Need more control over your form layout? Use `form_widget()` to render just the field element instead of the entire `form_row()`. You can also render each part separately: - `form_label()` - `form_widget()` - `form_errors()` - `form_help()` Perfect for custom form layouts 🎨 Check out the full course 👉 https://symfonycasts.com/screencast/symfony-forms

youtu.be

Upgrading to Symfony 8 #5 With the "hard" work behind us, the actual jump from Symfony 7.4 to 8.0 should be pretty easy. Plus, we'll check out a nifty Composer command afterward to confirm we have no outdated 😉 packages.

Upgrading to Symfony 8.0!

Symfony 7.4? Check

symfonycasts.com

Upgrading to Symfony 8 #4 Fixing all deprecations in Symfony 7.4 is required before upgrading to Symfony 8. Let's look at how to find them and some tricks to make life easier! symfonycasts.com/screencast/s...

Tracking & Fixing Deprecations

Let's revisit deprecations as these are important to fix. As mentioned earlier, before you can safely jump to Symfony 8

symfonycasts.com

Upgrading to Symfony 8 #3 Now that we’re on PHP 8.4, let's upgrade DoctrineBundle to v3. This unlocks native lazy objects in Doctrine, my favorite PHP 8.4 feature! Let’s see how they change Doctrine and your entities.

Upgrading Doctrine & Native Lazy Objects

We need to upgrade the doctrine-bundle... but before we do, I want to give a refresher on a really cool Doctrine feature: lazy objects. Open up "src/Entity/StarshipPart

symfonycasts.com

🚀 New in Symfony 8.1: Console Argument Resolvers ➡️ https://symfony.com/blog/new-in-symfony-8-1-console-argument-resolvers

Join us next month on June 4 in Montreal, Canada for SymfonyDay! There is an awesome lineup of speakers and I can't wait to see you there! 🎟️ Get your ticket: live.symfony.com/2026-montreal/

Upgrading to Symfony 8 #2 Before jumping to Symfony 8, let's upgrade to the latest 7.4 and explore some new features. Remember: Symfony 8.0 = Symfony 7.4 with deprecations removed.

Upgrading to Symfony 7.4

Alright, let's dive right into upgrading to Symfony 7.4

symfonycasts.com

New course alert! 🚨 Upgrading to Symfony 8: Let's upgrade an app from Symfony 7.3 to 8.0! We’ll start by switching to PHP 8.4, updating to the latest 7.3, refreshing Flex recipes, and tackling deprecations. All without breaking a sweat!

PHP 8.4 & Recipe Updates

Hey friends! Welcome to a new course on upgrading a Symfony app from Symfony 7 to Symfony 8. Luckily, newer versions of Symfony make this upgrade process a breeze

symfonycasts.com