Skip to content

Explaining controllers as viable alternative #13554

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 8 commits into from
Aug 3, 2020
Merged

Explaining controllers as viable alternative #13554

Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
40bbd81
Explaining controllers as viable alternative
ThomasLandauer Apr 16, 2020
2bc5c54
Update voters.rst
ThomasLandauer Apr 16, 2020
164aec4
[#13554] Slightly reworded the tip
wouterj Apr 16, 2020
221bbb1
Update voters.rst
ThomasLandauer Apr 16, 2020
fdfd1ad
Update security/voters.rst
ThomasLandauer Apr 17, 2020
577dfa2
Update voters.rst
ThomasLandauer Apr 17, 2020
bb0872a
Update voters.rst
ThomasLandauer Apr 17, 2020
15c4adc
Update voters.rst
ThomasLandauer Apr 21, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 17 additions & 6 deletions security/voters.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,19 +6,30 @@
How to Use Voters to Check User Permissions
===========================================

Security voters are the most granular way of checking permissions (e.g. "can this
specific user edit the given item?"). This article explains voters in detail.
Voters are Symfony's most powerful way of managing permissions. They allow you
to centralize all permission logic, then reuse them in many places.

However, if you don't reuse permissions or your rules are basic, you can always
put that logic directly into your controller instead. Here's an example how
this could look like, if you want to make a route accessible to the "owner" only::

// src/AppBundle/Controller/PostController.php
// ...

if ($post->getOwner() !== $this->getUser()) {
throw $this->createAccessDeniedException();
}

In that sense, the following example used throughout this page is a minimal
example for voters.

.. tip::

Take a look at the
:doc:`authorization </components/security/authorization>`
article for an even deeper understanding on voters.

How Symfony Uses Voters
-----------------------

In order to use voters, you have to understand how Symfony works with them.
Here's how Symfony works with voters:
All voters are called each time you use the ``isGranted()`` method on Symfony's
authorization checker or call ``denyAccessUnlessGranted`` in a controller (which
uses the authorization checker), or by
Expand Down