NotificationsYou must be signed in to change notification settings
Fork9.6k
Star30.4k

[HttpKernel] Fix`CacheAttributeListener` priority#48524

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.

Already on GitHub?Sign in to your account

Jump to bottom

Merged

nicolas-grekas merged 1 commit intosymfony:6.2fromHypeMC:cacheattributelistener-priority-fix

Dec 13, 2022

Merged

[HttpKernel] Fix`CacheAttributeListener` priority#48524

nicolas-grekas merged 1 commit intosymfony:6.2fromHypeMC:cacheattributelistener-priority-fix

Dec 13, 2022

Conversation

Copy link

Member

HypeMC commentedDec 6, 2022•
edited
Loading

Q	A
Branch?	6.2
Bug fix?	yes
New feature?	no
Deprecations?	no
Tickets	-
License	MIT
Doc PR	-

Currently theCacheAttributeListener & theIsGrantedAttributeListener have the same priority:

Registered Listeners for "kernel.controller_arguments" Event============================================================ ------- --------------------------------------------------------------------------------------------------------- ----------   Order   Callable                                                                                                  Priority   ------- --------------------------------------------------------------------------------------------------------- ----------   #1      Symfony\Component\HttpKernel\EventListener\CacheAttributeListener::onKernelControllerArguments()          10          #2      Symfony\Component\Security\Http\EventListener\IsGrantedAttributeListener::onKernelControllerArguments()   10          #3      Symfony\Component\HttpKernel\EventListener\ErrorListener::onControllerArguments()                         0          ------- --------------------------------------------------------------------------------------------------------- ----------

Since theCacheAttributeListener is alphabetically first, it's first to get triggered. This can cause an unauthenticated user to receive a 304 Not modified instead of a 302 Redirect, resulting in the user seeing some stale content from when they were authenticated instead of getting redirected to the login page.

This PR changes the priority of theCacheAttributeListener to be lower than that of theIsGrantedAttributeListener.