warn of Symfony\Component\Security\Core\Authorization\Voter\Voter use with subjects #20732
Comments
|
@landure looking at the code: https://github.com/symfony/symfony/blob/cadcc578af9ad9fe7a8dc87aa545083f23950e12/src/Symfony/Component/Security/Core/Authorization/AccessDecisionManager.php#L106 It's true that the cache is done by attribute + object class ... but the voter is called with the actual object every time. We don't cache the full voter result; we only cache the decision whether a voter should be called for some object. E.g. "can I edit blog post with id = 3?" will cache: "attribute: 'edit' class: 'BlogPost::class'" and then calls the voter with blog post (id = 3) But, if I later call "can I edit blog post with id = 5?", it will call the voter directly (because that check is cached) but this time it will call the voter with blog post (id = 5) instead of id = 3. Do you see any problem with that behavior? Or maybe I missed something in your question. |
|
My bad. I misinterpreted the behavior, since for a reason or another, my custom voter was not called. Thank you for taking the time to correct me. |
Symfony\Component\Security\Core\Authorization\Voter\Voteris aCacheableVoterInterface.The results are cached by subject class, not by subject value, or
ORM\Id.When the Voter must depend on the subject value (or state), the Voter result should not be cached.
Please add a warning like this one:
The
AccessDecisionManagercache voters' results by subject class, not by subject value. If the Voter result depends on the subject value, don't extendSymfony\Component\Security\Core\Authorization\Voter\Voter, implementVoterInterfacedirectly.The text was updated successfully, but these errors were encountered: