Skip to content

[Security]IsGranted - Denied message 6.2 #48789

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
boskos-q opened this issue Dec 26, 2022 · 4 comments
Closed

[Security]IsGranted - Denied message 6.2 #48789

boskos-q opened this issue Dec 26, 2022 · 4 comments
Labels
Security

Comments

@boskos-q
Copy link

boskos-q commented Dec 26, 2022 •
edited
Loading

Description

With the current changes and migration of #[IsGranted] from FrameworkExtraBundle in #44705 and with security in mind, having "bad/invalid credentials" message as Access Denied by #[IsGranted(%s)] on controller is all against any security policy. With this message, you're exposing your roles to the potential attacker that are required to access on specific route.
Because of that, I'm proposing/suggesting to change this default message as it was before (in FrameworkExtraBundle - which is generic one), Access Denied.

Example

No response
@nicolas-grekas
Copy link
Member

Isn't this displayed only in dev mode?

@boskos-q
Copy link
Author

Isn't this displayed only in dev mode?

https://github.com/nicolas-grekas/symfony/blob/6.2/src/Symfony/Component/Security/Http/EventListener/IsGrantedAttributeListener.php#L63
@nicolas-grekas I don't see any checks for dev mode, or I missed something ?

@nicolas-grekas
Copy link
Member

Exception rendering is not done by the listener. AFAIK, we don't display any messages unless the app runs in debug mode.
Just give your report a try :)

@chalasr
Copy link
Member

chalasr commented Dec 28, 2022

Closing for now as it seems there is no issue, please comment if you think otherwise so we can consider to reopen. Thanks

@chalasr chalasr closed this as not planned Won't fix, can't repro, duplicate, stale Dec 28, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
Security
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
4 participants
@nicolas-grekas @chalasr @carsonbot @boskos-q