Authentication, authorization, roles, voters, firewalls... there's a lot happening inside Symfony's Security system. But once you understand how the pieces fit together, it's a powerful and flexible system for answering two fundamental questions: who is this user, and what are they allowed to do?
We're excited to announce our newest SymfonyCasts course:
👉 Symfony Security: The Basics
In this course, we start from zero and build a complete security system. We'll create
our User class, build login and registration forms, hash passwords, add "remember
me", protect pages with roles, and explore how authentication works behind the
scenes.
Then we'll move into authorization: access control, role hierarchies, voters, impersonation, and the tools Symfony gives us to decide whether a user can perform a specific action.
The course uses Symfony 8, but everything we cover also works with Symfony 7.
What This Course Covers
We start with the fundamentals and gradually build a real authentication and authorization system.
Some of the key topics include:
- Installing and configuring Symfony Security
- Creating the
Userclass and user provider - Building a login form
- Understanding password hashing and automatic password upgrades
- Accessing the logged-in user
- Protecting logout with CSRF
- Adding "remember me" authentication
- Understanding Symfony's authentication attributes
- Creating and using roles
- Configuring role hierarchy and
access_control - Fetching the current user from controllers and services
- Creating custom voters for object-level permissions
- Impersonating users with
switch_user - Detecting and exiting impersonation
- Limiting login attempts with the Rate Limiter
- Listening to security events
- Building a registration form
The goal isn't just to get a login form working. By the end, you'll understand the core pieces of Symfony Security and how they work together to authenticate users and control what they're allowed to do.
Who Is This For?
This course is perfect if you:
- Are new to Symfony Security and want a solid foundation
- Have built login systems before but want to understand what's happening underneath
- Want to better understand the difference between authentication and authorization
- Need to protect your application with roles, access control, and voters
- Want to understand features like remember me, impersonation, and login throttling
Security doesn't need to feel mysterious. Once you understand the core concepts, Symfony gives you a lot of power without requiring a lot of code.
In Case You Missed It...
We've also been experimenting with a pretty exciting new approach to end-to-end testing: using a real browser with Symfony, but without running a web server.
- Playwright-PHP Changes the Game for Symfony Testing - see how Playwright-PHP can hand browser requests directly to Symfony's kernel, giving you real JavaScript alongside container access, PHP exceptions, database rollbacks, and parallel testing.
And yes, we're turning this into a course!
What's Next on SymfonyCasts?
Want to take Symfony Security even further? That's exactly where we're headed next:
- Symfony Security: Going Further - build on the fundamentals with sudo mode, smarter login flows, custom voters, impersonation hardening, compromised-password checks, rate limiting, and more.
And after security, we're turning our attention to testing:
- E2E Testing - we'll use the Playwright-PHP approach above to test complete user flows in a real browser with real JavaScript - while keeping all the advantages of testing directly against Symfony's kernel.
Stay tuned - there's plenty more Symfony Security and testing goodness on the way!