title: Symfony 4.4 - Returning a JSON Response of my user (getUser()) but I GET only NULL : security issue?
body: <p>TLDR: When I want to return a JSON response with my User (-&gt;getUser()), accessible in GET (I test with Postman) I have only an empty JSON or NULL. While the same method works inside Symfony.</p>
  <p>I am on a project based on Symfony 4.4 and ReactJS.
  I created my User entity with the Security-bundle.</p>
  <p>I made a controller to return a JSON response containing User's data.</p>
  <p><div class="snippet" data-lang="js" data-hide="false" data-console="true" data-babel="false">
  <div class="snippet-code">
  <pre class="snippet-code-html lang-html prettyprint-override"><code>&lt;?php
  
  namespace App\Controller\Api;
  
  
  use Symfony\Component\HttpFoundation\JsonResponse;
  use Symfony\Component\HttpFoundation\Request;
  use Symfony\Component\HttpFoundation\Response;
  use Symfony\Component\Routing\Annotation\Route;
  use Symfony\Component\Security\Core\Security;
  
  class UserConnectedController extends TypedController
  {
      /**
       * @var Security
       */
      private Security $security;
  
      public function __construct(Security $security)
      {
          $this-&gt;security = $security;
      }
      /**
       * @Route("/api/user", name="user_connected", methods={"GET"})
       * @param Request $request
       * @return JsonResponse|Response
       */
      public function user(Request $request){
          $user = $this-&gt;security-&gt;getUser();
  
          return new JsonResponse($user);
          
      }
  
  }</code></pre>
  </div>
  </div>
  </p>
  <p>When I try to fetch this url with Postman (GET), I only have &quot;NULL&quot;.
  However, when I want to get this user inside Symfony (dumping it in a twig for example) it works perfectly.</p>
  <p>Why is this $user accessible only in Symfony and not through a GET request ?
  Is there any security-related issue ?</p>
  <p>So far I've tried :</p>
  <ul>
  <li>different way of returning the JSON (new JsonResponse, $this-&gt;json, homemade function that is working to fetch others DB informations like a list of categories for example) : I always get NULL or am empty JSON.</li>
  <li>I moved this method into different controllers, such as securitycontroller.php, its the same.</li>
  <li>I modified the security.yaml firewall as written in the docs (<a href="https://symfony.com/doc/current/security/json_login_setup.html" rel="nofollow noreferrer">https://symfony.com/doc/current/security/json_login_setup.html</a>)</li>
  </ul>
  <p>None of these worked.
  If you have any hint, it will be much appreciated. Thanks in advance.</p>