[Security] Explain lazy anonymous mode #13171
Conversation
78a5271 to
7914566
Compare
security.rst
Outdated
| Nope, thanks to the ``anonymous`` key, this firewall *is* accessible anonymously. | ||
| It is useful to let users be authenticated as anonymous. It means any request | ||
| can have an anonymous token to access some resource, while some actions can require | ||
| some privileges. |
There was a problem hiding this comment.
I'm unsure if this is better than the original sentence. "tokens" is something that the reader at this point doesn't understand and the read flow looks better when starting with "No, ...".
There was a problem hiding this comment.
I don't agree on this one. API token is used a few line above, and guards are the main entry point now. Indeed, the flow is broken but I propose to change it all together. The anonymous concept has always been confusing and deserves to be clear as soon as we can since it is the first setting to start with, the sentence itself is clear enough IMO.
Furthermore, before the next line we encourage to see the WDT showing an authenticated anonymous user with an anonymous token, currently we're saying that Symfony is tricking us, instead of being explicit without explaining all the internals. Enough words :), what do you think of my new change?
7914566 to
8989172
Compare
8989172 to
481f0e2
Compare
bc1dbdd to
414f820
Compare
414f820 to
42e6ad7
Compare
|
Hi Jules! After a re-read this PR, I like the changes. I'm not sure if I wrongly read it the first time or you did lots of improvements afterwards, but I decided to merge this PR :) I've done a little rewording in b64dd02 after the merge (looks more major due to line breaking changes). Let me know if you think some of them are invalid. |
* 4.4: [#13171] Some small rewordings [Security] Explain lazy anonymous mode
* 5.0: [#13171] Some small rewordings [Security] Explain lazy anonymous mode
|
Nice :), thanks @wouterj 👍 |
Fixes #12390.
I'm not sure about documenting the abstract listener, since we try here to simplify all the docs in the component. I guess this is a very advance use case to create a custom firewall (never document for now AFAIK) so this should be another issue/PR, or even a blog post.