php-symfony-api-platform-security

What problem does it solve?

Securing API Platform resources in Symfony applications requires precise, expressive access control to protect data while enabling legitimate use. This skill provides a structured approach to enforce authentication and authorization across operations, ensuring only authorized users can read, modify, or delete resources.

Core Features & Use Cases

• Operation-level security: apply security expressions on Get, GetCollection, Post, Put, Patch, and Delete to enforce role-based access and ownership rules.
• Voters for complex logic: implement custom voters to handle nuanced permissions beyond built-in roles.
• Ownership and visibility: enforce resource visibility and actions based on the current user and resource relationships.
• JWT and role integration: combine JWT-based authentication with role checks to secure API endpoints across the stack.
• Use Case: protect a Post resource so only admins or the post owner can edit or delete, while everyone can read.

Quick Start

Configure a secure ApiResource with a security expression and a basic RBAC rule to see immediate access control.