Uh oh!
There was an error while loading.Please reload this page.
- Notifications
You must be signed in to change notification settings - Fork9.7k
[SecurityBundle] Revert adding_stateless attribute to the request when firewall is stateless and the attribute is not already set#58017
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.
Already on GitHub?Sign in to your account
Uh oh!
There was an error while loading.Please reload this page.
Conversation
nicolas-grekas commentedAug 16, 2024
I'd go with a bugfix on my side. The side-effect of reverting this on 6.4 would be that requests won't be marked as stateless anymore for some, and that should be fine since this is just adding a safeguard, isn't it? |
chalasr commentedAug 16, 2024
I agree with reverting this on 6.4. |
…when firewall is stateless and the attribute is not already set
MatTheCat commentedAug 16, 2024 • edited
Loading Uh oh!
There was an error while loading.Please reload this page.
edited
Uh oh!
There was an error while loading.Please reload this page.
Rebased on 6.4 and updated the description accordingly. @nicolas-grekas yes the only impact is that you’ll no longer be warned about session usage from a route configured as stateless under a stateless firewall. @chalasr not sure about what you’re proposing, but I guess that would be another PR anyway! |
nicolas-grekas commentedAug 16, 2024
Thank you@MatTheCat. |
… routes as stateless (MatTheCat)This PR was merged into the 6.4 branch.Discussion----------[Security] Remove note about stateless firewalls marking routes as statelessFollowingsymfony/symfony#58017Commits-------768ef5a [Security] Remove note about stateless firewalls marking routes as stateless
Uh oh!
There was an error while loading.Please reload this page.
#40372 was about routes matching both stateful and stateless firewalls: you couldn’t easily configure them as stateless under a stateless firewall only.
#48044 fixed it by linking these two attributes: a stateless firewall then implied a stateless request. While it can sound logical, this impacted many projects using the session while authenticating users in a stateless fashion.
At last,#49997 allowed to override this behavior by explicitly configuring routes asnot stateless. This kind of proved that#48044 was a mistake: you cannot tell a request must be stateless only because it matches a stateless firewall.
As such, this PR reverts#48044 (and consequently#49997) so that configuring routes as stateless is the developers responsibility alone. It also reopens#40372, but I think this issue should be fixed in an opt-in way (with a new
firewall.stateless.with_routesboolean configuration in the SecurityBundle e.g.).