[HttpKernel] Add `#[IsSignatureValid]` attribute #60395

santysisi · 2025-05-09T21:24:34Z

Q	A
Branch?	7.4
Bug fix?	no
New feature?	yes
Deprecations?	no
Issues	Feature #60189
License	MIT

✨ New Feature: `#[IsSignatureValid]` Attribute

This attribute enables declarative signature validation on controller actions. It ensures that requests using specific HTTP methods are validated using UriSigner. If the signature is invalid, a SignedUriException is thrown.

✅ Usage Examples

#[IsSignatureValid] // Applies to all HTTP methods by default
public function someAction(): Response

#[IsSignatureValid(methods: ['POST', 'PUT'])] // Only validates POST and PUT requests
public function updateAction(): Response

#[IsSignatureValid(signer: 'my_custom_signer_service')] // Uses a custom UriSigner service
public function customSignedAction(): Response

santysisi · 2025-05-09T22:43:16Z

Hi 👋
I'll update this version 7.3 to 7.4 once the new minor dev version is released.

Edit: I updated this version to 7.3 because I need this method from UriSigner.

src/Symfony/Component/Security/Http/EventListener/IsSignatureValidAttributeListener.php

kbond · 2025-05-12T13:45:53Z

This is looking great @santysisi! I'll give it a more thorough review after 7.3 is released.

santysisi · 2025-05-19T04:37:22Z

We could also consider adding an extra argument to the attribute called methods to restrict the validation to specific HTTP methods. This would align with the current behavior of the IsCsrfTokenValid attribute.

santysisi · 2025-05-30T03:40:30Z

We could also consider adding an extra argument to the attribute called methods to restrict the validation to specific HTTP methods. This would align with the current behavior of the IsCsrfTokenValid attribute.

Hi 👋 I'll update this version 7.3 to 7.4 once the new minor dev version is released.

Edit: I updated this version to 7.3 because I need this method from UriSigner.

ready these 2 changes 🚀

kbond

This looks really great, nice work @santysisi!

santysisi · 2025-06-05T01:26:36Z

I believe the error is not relevant 🤔
I only rebased the branch to resolve some conflicts, so there shouldn't be any functional changes introduced.

src/Symfony/Bundle/SecurityBundle/composer.json

src/Symfony/Component/Security/Http/Attribute/IsSignatureValid.php

src/Symfony/Component/Security/Http/composer.json

santysisi · 2025-07-12T19:58:55Z

src/Symfony/Component/Security/Http/composer.json

@@ -37,7 +37,8 @@
        "symfony/security-csrf": "^6.4|^7.0|^8.0",
        "symfony/translation": "^6.4|^7.0|^8.0",
        "psr/log": "^1|^2|^3",
-        "web-token/jwt-library": "^3.3.2|^4.0"
+        "web-token/jwt-library": "^3.3.2|^4.0",
+        "symfony/dependency-injection": "^6.4|^7.0|^8.0"


I added the symfony/dependency-injection component as a dev dependency because I need the ContainerBuilder to test the new CompilerPass.

kbond · 2025-07-14T14:42:07Z

src/Symfony/Component/Security/Http/DependencyInjection/UriSignerLocatorPass.php

+    public function process(ContainerBuilder $container): void
+    {
+        $locateableServices = [];
+        foreach ($container->getDefinitions() as $id => $definition) {


I don't think looping over all the definitions is the correct method to handle this. @nicolas-grekas wdyt?

Also, UriSigner isn't final so it could be an sub-class.

Hi 👋 Thanks a lot for your comment!

You're absolutely right, that was totally my mistake 🙏 .
Since UriSigner isn’t final, it can indeed be subclassed. I’ve updated the condition in the if statement to use is_a to correctly check if it's an instance of UriSigner or one of its subclasses.

I also added a test to cover this behavior and ensure it works as expected.

Thanks again for catching that ❤️

🤔 You might be right and apologies if this isn’t the proper way to handle it.
I based my implementation on existing methods in ContainerBuilder, like findTaggedServiceIds, findTaggedResourceIds, and findTags, which also loop through definitions. But again, that might not be ideal in this case, sorry about that!

I'd really appreciate your input on a better approach. If you can suggest one, I’ll be happy to update the code to follow your recommendation.

Thanks again!

Hi! 👋

I’ve tried a new approach to create the ServiceLocator.
I added autoconfiguration for UriSigner with a security.uri_signer tag, and I’m now using findTaggedServiceIds instead of looping through all the definitions.

Please let me know if this method looks better to you 😄
Thanks again! ❤️

Edit: I was also thinking , maybe we could introduce a UriSignerInterface instead. That way, instead of autoconfiguring the concrete UriSigner, we could autoconfigure services implementing UriSignerInterface. This change would allow developers to pass not only the UriSigner service or ones that extend it, but any custom service that implements the interface.

Wdyt? If you agree, I’d be happy to open another PR to add the interface 😄

…h argument (santysisi) This PR was merged into the 7.4 branch. Discussion ---------- [HttpKernel][Security] Refactor: use `getAttributes` with argument | Q | A | ------------- | --- | Branch? | 7.4 | Bug fix? | no | New feature? | no | Deprecations? | no | Issues | no | License | MIT Refactored code to consistently use `$event->getAttributes($className)` instead of accessing the full array. This simplifies attribute retrieval and improves readability. [Reference](#60395 (comment)) Commits ------- 6769c9a [HttpKernel][Security] Refactor: use `getAttributes` with argument

…h argument (santysisi) This PR was merged into the 7.4 branch. Discussion ---------- [HttpKernel][Security] Refactor: use `getAttributes` with argument | Q | A | ------------- | --- | Branch? | 7.4 | Bug fix? | no | New feature? | no | Deprecations? | no | Issues | no | License | MIT Refactored code to consistently use `$event->getAttributes($className)` instead of accessing the full array. This simplifies attribute retrieval and improves readability. [Reference](symfony/symfony#60395 (comment)) Commits ------- 6769c9a8287 [HttpKernel][Security] Refactor: use `getAttributes` with argument

kbond · 2025-07-15T12:37:19Z

src/Symfony/Component/Security/Http/DependencyInjection/UriSignerLocatorPass.php

+ *
+ * @author Santiago San Martin <sanmartindev@gmail.com>
+ */
+class UriSignerLocatorPass implements CompilerPassInterface


I think the tagged service is the way to go. If so, we don't need this compiler pass. You can register controller.is_signature_valid_attribute_listener in config and use tagged_locator() for its argument.

Thanks for your help! ❤️ I've made the changes.

Edit: There are some errors, I'll try to resolve them tonight.

kbond · 2025-07-15T19:26:12Z

Awesome, let's wait for some others to take a look. As I said, I think tagged services is the way to go but maybe someone has a different idea.

alexander-schranz · 2025-07-18T06:54:54Z

I did not go over all comments, but for me it looks false this live inside Security namespace.

The UriSigner I can use currently without any SecurityBundle / Security services, so from my point of view the attribute should work also without any security related service and be more part of the FrameworkBundle like the UriSigner service itself.

santysisi · 2025-07-19T19:45:47Z

I did not go over all comments, but for me it looks false this live inside Security namespace.

The UriSigner I can use currently without any SecurityBundle / Security services, so from my point of view the attribute should work also without any security related service and be more part of the FrameworkBundle like the UriSigner service itself.

Hi 👋 First of all, thank you very much for your comment 😊

You're right. When I started working on this feature, I saw this new attribute as something similar to IsGranted or IsCsrfTokenValid, which is why I initially placed it in the symfony/security-http component and the symfony/security-bundle bundle.

However, you're right that UriSigner resides in the symfony/http-foundation component and can be used without the symfony/security-bundle or any other security components. Therefore, it would make more sense for this attribute to reside in HttpFoundation and be part of the FrameworkBundle instead of the SecurityBundle.

Thanks again for the comment!

What do you think, @kbond?

kbond · 2025-07-21T14:20:28Z

Yeah, this is a good point. I wonder if http-kernel would be the better spot? This component has other controller-related attributes/listeners.

alexander-schranz · 2025-07-21T14:45:03Z

@kbond HttpKernel sounds good for me if I look at the attributes there: https://github.com/symfony/symfony/tree/7.4/src/Symfony/Component/HttpKernel/Attribute

santysisi · 2025-07-21T22:42:14Z

Moved the attribute to the HttpKernel component 😄

santysisi requested a review from chalasr as a code owner May 9, 2025 21:24

carsonbot added Status: Needs Review Feature HttpFoundation labels May 9, 2025

carsonbot added this to the 7.3 milestone May 9, 2025

santysisi force-pushed the feature/verify-signature-attribute branch 5 times, most recently from 4730169 to c72ef83 Compare May 9, 2025 22:27

94noni reviewed May 10, 2025

View reviewed changes

src/Symfony/Component/Security/Http/EventListener/IsSignatureValidAttributeListener.php Outdated Show resolved Hide resolved

santysisi force-pushed the feature/verify-signature-attribute branch from c72ef83 to 85320cf Compare May 18, 2025 03:00

fabpot modified the milestones: 7.3, 7.4 May 26, 2025

santysisi force-pushed the feature/verify-signature-attribute branch from 85320cf to c000b69 Compare May 29, 2025 23:01

kbond approved these changes May 30, 2025

View reviewed changes

carsonbot added Status: Reviewed and removed Status: Needs Review labels May 30, 2025

santysisi force-pushed the feature/verify-signature-attribute branch from c000b69 to 24fca48 Compare June 4, 2025 00:50

santysisi mentioned this pull request Jun 4, 2025

[HttpFoundation] Add documentation for #[IsSignatureValid] attribute symfony/symfony-docs#21041

Open

santysisi force-pushed the feature/verify-signature-attribute branch from 24fca48 to 524b686 Compare June 5, 2025 00:50

nicolas-grekas reviewed Jun 5, 2025

View reviewed changes

src/Symfony/Bundle/SecurityBundle/composer.json Outdated Show resolved Hide resolved

nicolas-grekas reviewed Jun 5, 2025

View reviewed changes

src/Symfony/Component/Security/Http/Attribute/IsSignatureValid.php Outdated Show resolved Hide resolved

nicolas-grekas reviewed Jun 5, 2025

View reviewed changes

src/Symfony/Component/Security/Http/Attribute/IsSignatureValid.php Outdated Show resolved Hide resolved

nicolas-grekas reviewed Jun 5, 2025

View reviewed changes

src/Symfony/Component/Security/Http/composer.json Outdated Show resolved Hide resolved

carsonbot added Status: Needs Review and removed Status: Needs Work labels Jul 12, 2025

santysisi commented Jul 12, 2025

View reviewed changes

santysisi force-pushed the feature/verify-signature-attribute branch from 2290ba3 to 5d3a69a Compare July 12, 2025 20:03

santysisi mentioned this pull request Jul 13, 2025

[HttpKernel][Security] Refactor: use getAttributes with argument #61112

Merged

kbond reviewed Jul 14, 2025

View reviewed changes

santysisi force-pushed the feature/verify-signature-attribute branch 4 times, most recently from 30c02bd to f20400b Compare July 15, 2025 10:47

kbond reviewed Jul 15, 2025

View reviewed changes

santysisi force-pushed the feature/verify-signature-attribute branch 3 times, most recently from a7d8c95 to 1d8202c Compare July 15, 2025 13:25

santysisi force-pushed the feature/verify-signature-attribute branch from 1d8202c to d2ff216 Compare July 17, 2025 22:47

santysisi mentioned this pull request Jul 17, 2025

Attribute for UriSigned controllers #61149

Closed

santysisi force-pushed the feature/verify-signature-attribute branch from d2ff216 to 35cbbc0 Compare July 18, 2025 22:42

santysisi force-pushed the feature/verify-signature-attribute branch from 35cbbc0 to 0c3ec83 Compare July 21, 2025 22:06

santysisi changed the title ~~[HttpFoundation] Add #[IsSignatureValid] attribute~~ [HttpKernel] Add #[IsSignatureValid] attribute Jul 21, 2025

santysisi force-pushed the feature/verify-signature-attribute branch from 0c3ec83 to 5b0b74e Compare July 21, 2025 22:43

[HttpKernel] Add #[IsSignatureValid] attribute

c304021

santysisi force-pushed the feature/verify-signature-attribute branch from 5b0b74e to c304021 Compare August 16, 2025 23:30

Uh oh!

[HttpKernel] Add #[IsSignatureValid] attribute #60395

Are you sure you want to change the base?

[HttpKernel] Add #[IsSignatureValid] attribute #60395

Conversation

santysisi commented May 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✨ New Feature: #[IsSignatureValid] Attribute

✅ Usage Examples

Uh oh!

santysisi commented May 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

kbond commented May 12, 2025

Uh oh!

santysisi commented May 19, 2025

Uh oh!

santysisi commented May 30, 2025

Uh oh!

kbond left a comment

Choose a reason for hiding this comment

Uh oh!

santysisi commented Jun 5, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

santysisi Jul 12, 2025

Choose a reason for hiding this comment

Uh oh!

kbond Jul 14, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

santysisi Jul 14, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

santysisi Jul 14, 2025

Choose a reason for hiding this comment

Uh oh!

santysisi Jul 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

kbond Jul 15, 2025

Choose a reason for hiding this comment

Uh oh!

santysisi Jul 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

kbond commented Jul 15, 2025

Uh oh!

alexander-schranz commented Jul 18, 2025

Uh oh!

santysisi commented Jul 19, 2025

Uh oh!

kbond commented Jul 21, 2025

Uh oh!

alexander-schranz commented Jul 21, 2025

Uh oh!

santysisi commented Jul 21, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

[HttpKernel] Add `#[IsSignatureValid]` attribute #60395

[HttpKernel] Add `#[IsSignatureValid]` attribute #60395

santysisi commented May 9, 2025 •

edited

Loading

✨ New Feature: `#[IsSignatureValid]` Attribute

santysisi commented May 9, 2025 •

edited

Loading

kbond Jul 14, 2025 •

edited

Loading

santysisi Jul 14, 2025 •

edited

Loading

santysisi Jul 15, 2025 •

edited

Loading

santysisi Jul 15, 2025 •

edited

Loading

santysisi commented Jul 21, 2025 •

edited

Loading