Skip to content

Using isGranted() without a Session #43372

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
natewiebe13 opened this issue Oct 8, 2021 · 9 comments · Fixed by #48142
Closed

Using isGranted() without a Session #43372

natewiebe13 opened this issue Oct 8, 2021 · 9 comments · Fixed by #48142
Labels
Feature Security

Comments

@natewiebe13
Copy link
Contributor

Description
isGranted() assumes that it's checking against the currently logged in user. It would be great to be able to use something similar to check against another user or during times when there isn't a session (cronjobs/commands, message queue, etc.).

I would see this as a userIsGranted() function to make a distinction. There's cases we'd have to consider, such as if IS_AUTHENTICATED_* is used in conjunction with this method, as those are based on sessions. Return false, or throw a logic exception, etc.

Having this functionality would allow for removing the dependency on sessions entirely for services reducing the number of issues that come up during a project because some underlying function was session dependent.

I'm assuming we'd also want to create a new Token class to represent checking against a non-logged in user.

Example
Checking to see if you could assign another user to review an article:

$security->userIsGranted($reviewer, ArticleVoter::REVIEW, $article);
@xabbuh xabbuh added the Security label Oct 8, 2021
@lyrixx
Copy link
Member

lyrixx commented Oct 11, 2021 •
edited
Loading

You can use the AccessDecisionManager Directly

$adm->decide(new PostAuthenticationToken($reviewer, '', $reviewer->getRoles()), [ArticleVoter::REVIEW], $article);

But indeed, a simpler way could be better 👍🏼

@renanbr
Copy link
Contributor

renanbr commented Nov 25, 2021 •
edited
Loading

@natewiebe13 I had the same need,

I end up implementing my own Security service that provider isGrantedFor() methods, which calls AccessDecisionManagerInterface internally. I've also created a is_granted_for() twig function.

As consequence, I had to update all userland voters to rely on this method instead of the native one.

Limitation: if a voter depends on an external decision, it MUST propagate the given user by calling isGrantedFor().

The native voters don't do that.

By the way, this didn't give me problems until now.

@derrabus
Copy link
Member

derrabus commented Nov 25, 2021 •
edited
Loading

@renanbr I don't understand the part with the voters. Voters should not really depend on the authenticated user because they are called with a token.

@carsonbot
Copy link

Thank you for this suggestion.
There has not been a lot of activity here for a while. Would you still like to see this feature?

@natewiebe13
Copy link
Contributor Author

Keep it open. I have started on this already, just need to get around to writing tests/documentation and then I can make a PR.

@carsonbot carsonbot removed the Stalled label Jun 6, 2022
@natewiebe13 natewiebe13 mentioned this issue Nov 7, 2022
Merged
@carsonbot
Copy link

Thank you for this suggestion.
There has not been a lot of activity here for a while. Would you still like to see this feature?

@natewiebe13
Copy link
Contributor Author

Keep it open. PR now exists: #48142

@carsonbot carsonbot removed the Stalled label Dec 7, 2022
@carsonbot
Copy link

Thank you for this suggestion.
There has not been a lot of activity here for a while. Would you still like to see this feature?

@natewiebe13
Copy link
Contributor Author

Keep it open.

@carsonbot carsonbot removed the Stalled label Jul 4, 2023
@wouterj wouterj mentioned this issue Jul 4, 2024
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
Feature Security
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

[Security][SecurityBundle] User authorization checker natewiebe13/symfony
6 participants
@renanbr @lyrixx @natewiebe13 @derrabus @xabbuh @carsonbot