Kevin Bond (@zenstruck) header
Kevin Bond (@zenstruck) profile picture

Kevin Bond

@zenstruck

Open Source, #PHP, #Symfony Developer. Writer @SymfonyCasts, @Symfony Core Member. Author of https://nitter.cf/t.co/MK05b2VaRK packages.

 Kitchener, Ontario, Canada
github.com/kbond
Joined March 2009
  • Tweets1.3K
  • Following269
  • Followers918
43Media
Photo by Kevin Bond (@zenstruck)Photo by Kevin Bond (@zenstruck)Photo by Kevin Bond (@zenstruck)Photo by Kevin Bond (@zenstruck)Photo by Kevin Bond (@zenstruck)Photo by Kevin Bond (@zenstruck)Photo by Kevin Bond (@zenstruck)Photo by Kevin Bond (@zenstruck)Photo by Kevin Bond (@zenstruck)
#Symfony: "yours to discover"
Image from Kevin Bond (@zenstruck)
1
7
3
83
14,124
Kevin Bond retweeted
Symfony (@symfony) profile picture
Symfony
@symfonyOct 28
🚀 New in Symfony 8.2: Security Expressions Everywhere ➡️ symfony.com/blog/new-in-symf…
New in Symfony 8.2: Security Expressions Everywhere (Symfony Blog)

New in Symfony 8.2: Security Expressions Everywhere (Symfony Blog)

Symfony 8.2 brings security functions to more expressions and adds current_user() to access the logged-in user.

symfony.com
4
30
2,793
AI makes generating code easier. Making sure it works as expected, that’s where testing comes in. Join Diego's workshop "TDD the Right Way" at SymfonyCon Warsaw next month and put that code to the test! 🚀 Join the workshop → live.symfony.com/2026-warsaw…
Image from SymfonyCasts 🇺🇦 (@SymfonyCasts)
1
3
333
Super excited about this new Symfony 8.2 feature! Controller attributes like `#[IsCsrfTokenValid]` and `#[RateLimit]` can now pass failures to your controller instead of throwing exceptions. Convenient attributes AND user-friendly feedback! github.com/symfony/symfony/p…
[HttpKernel][Security] Let controllers handle the failures of their attributes by kbond · Pull...

[HttpKernel][Security] Let controllers handle the failures of their attributes by kbond · Pull...

Q A Branch? 8.2 Bug fix? no New feature? yes Deprecations? no Issues - License MIT I love all the controller attributes, but they feel more geared towards APIs than HTML pages. It&...

github.com
1
5
208
🔐 Symfony Security: Going Further #13 Login is throttled, but how do we stop a bot from registering 1000's of accounts? Let's configure a rate limiter by hand and put a hard cap on how often someone can sign up! 🚦 symfonycasts.com/screencast/…
Rate Limiting the Registration Form

Rate Limiting the Registration Form

Adds rate limiting to the registration form so a client can only create one account per 10 minutes, preventing mass sign-ups while preserving normal form validation flow.

symfonycasts.com
1
2
327
🔐 Symfony Security: Going Further #12 Want stronger passwords - and a way to reject any that have already leaked in a data breach? Symfony ships a constraint for each, and we'll bundle them into one reusable constraint of our own! symfonycasts.com/screencast/…
Requiring Strong, Uncompromised Passwords

Requiring Strong, Uncompromised Passwords

Create a reusable compound validation constraint for passwords so registration, password change, and password reset all enforce the same strong-password rules without duplicating validation logic.

symfonycasts.com
2
3
306
🔐 Symfony Security: Going Further #11 Need a change password form? Let's reuse the one the reset password maker already wrote for us, then ask for the current password too - with a very cool built-in constraint! symfonycasts.com/screencast/…
Adding a Change Password Form & UserPassword

Adding a Change Password Form & UserPassword

Builds a logged-in “change password” page in Symfony, reuses the existing password reset form type, and adds optional current-password validation with UserPassword.

symfonycasts.com
1
2
254
🔐 Symfony Security: Going Further #10 Need a forgot password flow? There's a maker for that! Let's generate the whole thing, log the user in automatically after a reset, and see how it avoids leaking who has an account! symfonycasts.com/screencast/…
Resetting a Forgotten Password

Resetting a Forgotten Password

Builds the standard forgotten-password flow in Symfony with SymfonyCasts ResetPasswordBundle: requesting a reset email, validating and consuming a reset token, updating the password, and optionally...

symfonycasts.com
2
3
297
🔐 Symfony Security: Going Further #9 Let's swap the built-in switch_user role for a custom attribute, let a voter make the call, & see how to check the permissions of any user - not just the one logged in. And, now our admins can't impersonate each other! symfonycasts.com/screencast/…
Restricting Impersonation with a Voter

Restricting Impersonation with a Voter

Restricts Symfony switch_user impersonation with a custom voter so users can’t impersonate themselves, regular admins can only impersonate non-admin users, and super admins can impersonate anyone...

symfonycasts.com
2
5
297
Kevin Bond retweeted
Symfony (@symfony) profile picture
Symfony
@symfonyOct 9
🚀 New in Symfony 8.2: Single-Use and Safer Signed URLs ➡️ symfony.com/blog/new-in-symf…
New in Symfony 8.2: Single-Use and Safer Signed URLs (Symfony Blog)

New in Symfony 8.2: Single-Use and Safer Signed URLs (Symfony Blog)

Symfony 8.2 lets you create single-use signed URLs and allows adding extra signed parameters to login links.

symfony.com
1
5
47
3,581
🔐 Symfony Security: Going Further #8 Let's give users the choice to log in with their email or username! We'll add unique usernames, update our login form, and teach Symfony how to find users by either one. symfonycasts.com/screencast/…
Logging in with a Username or Email

Logging in with a Username or Email

Adds a username field to User and changes Symfony login so a user can authenticate with either email or username, by wiring the Doctrine user repository into Symfony’s identifier-loading mechanism.

symfonycasts.com
2
1
293
🔐 Symfony Security: Going Further #7 After logging in, users should return to the page they were on, not the homepage! Let's use Symfony's _target_path to send them right back where they left off, making the login experience a little smoother! symfonycasts.com/screencast/…
Redirecting After Login with _target_path

Redirecting After Login with _target_path

Use a login-page query parameter to send users back to the page they were viewing before logging in, instead of always falling back to the default homepage target.

symfonycasts.com
2
5
319
🔐 Symfony Security: Going Further #6 Need a super admin who can do (almost) anything? Let's build a custom voter that grants sweeping permissions across our app, while making sure important authentication checks still behave normally! symfonycasts.com/screencast/…
Creating a Super Admin Voter

Creating a Super Admin Voter

Adds a dedicated SuperAdminVoter so a true super admin can bypass normal authorization checks without relying on role hierarchy, while preserving sensitive authentication-related checks like impers...

symfonycasts.com
2
7
303
🔐 Symfony Security: Going Further #5 Ever notice how GitHub asks you to confirm your password before sensitive actions? Let's build that same "sudo mode" in Symfony, requiring full authentication with a smooth password confirmation flow! symfonycasts.com/screencast/…
Sudo Mode: Requiring Full Authentication

Sudo Mode: Requiring Full Authentication

Implements “sudo mode” for the admin area by requiring full authentication, so remembered users must re-enter their password before accessing /admin, and updates the login form to support the re-auth...

symfonycasts.com
2
5
321
🔐 Symfony Security: Going Further #4 Wrong password, unknown email, disabled account... your login form answers all three with "Invalid credentials." That's deliberate. Let's decide how much we actually want to give away. symfonycasts.com/screencast/…
Customizing Authentication Error Messages

Customizing Authentication Error Messages

Symfony’s security system can expose different authentication failure messages, and this chapter shows how to balance user experience and account-enumeration risk by adjusting expose_security_errors,...

symfonycasts.com
2
5
322
Symfony Cache Contracts have a sneaky little trick 👀 Use `beta: INF` to force-refresh a cached value without deleting the old one first - so other requests can keep using it while the fresh value is computed. See how it works 👇 symfonycasts.com/blog/symfon…
Force Refresh a Symfony Cache Item with beta: INF

Force Refresh a Symfony Cache Item with beta: INF

Symfony's Cache Contracts have a mysterious third argument: "$beta". Here's where its name comes from, how it prevents cache stampedes, and how "beta: INF" lets you force a cache item to refresh...

symfonycasts.com
1
3
6
424
🔐 Symfony Security: Going Further #3 Disabling an account blocks the next login... but a user already browsing doesn't even notice. Let's show them the door mid-click. 👋 symfonycasts.com/screencast/…
Forcing Logout on Disabled Users

Forcing Logout on Disabled Users

Force users to be logged out as soon as their account becomes disabled by making the firewall detect a per-request change in the user’s roles.

symfonycasts.com
2
4
322
🔐 Symfony Security: Going Further #2 Deleting a user is forever. Sometimes you just want to switch them off. Let's teach our login to check more than the password. symfonycasts.com/screencast/…
Disabling Users with a Custom UserChecker

Disabling Users with a Custom UserChecker

Adds soft-disable support for users by storing a disabledAt timestamp, preventing disabled accounts from logging in, and setting up the security layer to recognize account status via a custom...

symfonycasts.com
2
3
296
Kevin Bond retweeted
Symfony (@symfony) profile picture
Symfony
@symfonySep 17
🚀 New in Symfony 8.2: Attribute-based Forms ➡️ symfony.com/blog/new-in-symf…
New in Symfony 8.2: Attribute-based Forms (Symfony Blog)

New in Symfony 8.2: Attribute-based Forms (Symfony Blog)

Symfony 8.2 allows you to define form classes with PHP attributes directly on your DTO classes.

symfony.com
14
53
3,563
🚀 New on the blog: our ideal GitHub Actions setup for Symfony apps! Tests, linting, PHPStan, code style, database/schema checks, Symfony-aware diagnostics, asset compilation, plus a scheduled Composer security audit. A solid CI baseline you can actually build from: symfonycasts.com/blog/ideal-…
Ideal GitHub Actions for Symfony Apps

Ideal GitHub Actions for Symfony Apps

A practical, modern GitHub Actions setup for Symfony apps, covering tests, linting, static analysis, database checks, Symfony-aware diagnostics, and scheduled dependency security audits.

symfonycasts.com
4
6
387
🚨 New Course 🚨 🔐 Symfony Security: Going Further #1 A 403 status code tells us we don't have access... but it also tells us the thing exists. Let's borrow the trick GitHub uses on private repositories 🖖 symfonycasts.com/screencast/…
Returning a 404 Instead of 403 with IsGranted

Returning a 404 Instead of 403 with IsGranted

Use #[IsGranted] on controller actions to return a 404 instead of a 403 for unauthorized access, hiding whether a resource exists and preventing information leaks.

symfonycasts.com
1
3
298
Load more