Security

Question 1

Which UserProviders does Symfony offer?

Answer 1

Entity User Provider

LDAP User Provider

Memory User Provider

Chain User Provider

Question 2

Which Role does the ROLE_SUPERADMIN have when the following configuration is given?

security:
    # ...

    role_hierarchy:
        ROLE_ADMIN:       ROLE_USER
        ROLE_SUPER_ADMIN: [ROLE_ADMIN, ROLE_ALLOWED_TO_SWITCH]

Answer 2

ROLE_USER, ROLE_ADMIN, ROLE_ALLOWED_TO_SWITCH

Question 3

How can routes be made accessible only for users with specific roles?

Answer 3

security:
    access_control:
        - { path: '^/admin', roles: ROLE_ADMIN }

Question 4

How can you deny access from inside a controller?

Answer 4

$this->denyAccessUnlessGranted('ROLE_ADMIN');

Question 5

How can you use access control inside templates?

Answer 5

{% if is_granted('ROLE_ADMIN') %}
    <a href="...">Delete</a>
{% endif %}

or for certain users

{% if is_granted_for_user(user, 'ROLE_ADMIN') %}
    <a href="...">Delete</a>
{% endif %}

Question 6

How can you give routes public access for none logged in users?

Answer 6

security:
    access_control:
        - { path: ^/admin/login, roles: PUBLIC_ACCESS }

Question 7

Which role does a user get, if hes logged in through the remember me cookie?

Answer 7

IS_REMEMBERED

Question 8

Which role does a user get in impersonation mode?

Answer 8

IS_IMPERSONATOR

Question 9

What does csrf mean?

Answer 9

Cross site request forgery

Question 10

How does csrf_protection work?

Answer 10

1. Symonfy adds a hidden token on the form that it generated on server side.
2. When a form is being submitted, symfony checks if it has a valid token

This will make sure the origin of the submitted form is symfony and therefore the user session is not being abused by another page that perfoms its own request (attack).

Question 11

How can you override the method symfony uses to load a user?

Answer 11

Add the UserLoaderInterface to the UserRepository and implement the method loadUserByIdentifier

Question 12

How can you make symfony decide which firewall to use?

Answer 12

The first match will apply. Matching can be:

• url-pattern
• host
• http-methods
• a custom request matcher that the dev can implement (RequestMatcherInterface)

Question 13

How can you improve performance even tho many voters are being used?

Answer 13

Use a CacheableVoterInterface

Question 14

How can you configure the voters to grant access in case all voters abstain?

Answer 14

In security-config:

       'access_decision_manager' => [
            'allow_if_all_abstain' => true,
        ],

Question 15

How can you configure the voters to grant access in case at least one voter grants access?

Answer 15

In security-config:

       'access_decision_manager' => [
            'strategy' => 'affirmative',
        ],

Question 16

How can you configure the voters to grant access in case there are more voters that grant access than voters that dont?

Answer 16

In security-config:

       'access_decision_manager' => [
            'strategy' => 'consensus',
        ],

Question 17

How can you configure the voters to grant access only if there is not a single voter not granting access?

Answer 17

In security-config:

       'access_decision_manager' => [
             'strategy' => 'unanimous',
        ],

Question 18

How can you configure the voters to grant access if the first voter that is being asked grants access? (abstain does not count here)

Answer 18

In security-config:

       'access_decision_manager' => [
             'strategy' => 'priority',
        ],

Question 19

How can you change the http status that is being returned in case the access is not granted?

Answer 19

The method “isGranted” provides an argument for that.