Movatterモバイル変換


[0]ホーム

URL:


Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Sign up
Appearance settings

[Security] Explain lazy anonymous mode#13171

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.

Already on GitHub?Sign in to your account

Merged
wouterj merged 1 commit intosymfony:4.4fromHeahDude:security/anonymous
Apr 11, 2020

Conversation

@HeahDude
Copy link
Contributor

Fixes#12390.

I'm not sure about documenting the abstract listener, since we try here to simplify all the docs in the component. I guess this is a very advance use case to create a custom firewall (never document for now AFAIK) so this should be another issue/PR, or even a blog post.

security.rst Outdated
Nope, thanks to the ``anonymous`` key, this firewall *is* accessible anonymously.
It is useful to let users be authenticated as anonymous. It means any request
can have an anonymous token to access some resource, while some actions can require
some privileges.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

I'm unsure if this is better than the original sentence. "tokens" is something that the reader at this point doesn't understand and the read flow looks better when starting with "No, ...".

Copy link
ContributorAuthor

@HeahDudeHeahDudeFeb 18, 2020
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

I don't agree on this one.API token is used a few line above, and guards are the main entry point now. Indeed, the flow is broken but I propose to change it all together. The anonymous concept has always been confusing and deserves to be clear as soon as we can since it is the first setting to start with, the sentence itself is clear enough IMO.
Furthermore, before the next line we encourage to see the WDT showing an authenticated anonymous user with an anonymous token, currently we're saying that Symfony is tricking us, instead of being explicit without explaining all the internals. Enough words :), what do you think of my new change?

wouterj added a commit that referenced this pull requestApr 11, 2020
@wouterjwouterj merged commitb129252 intosymfony:4.4Apr 11, 2020
@wouterj
Copy link
Member

wouterj commentedApr 11, 2020
edited
Loading

Hi Jules! After a re-read this PR, I like the changes. I'm not sure if I wrongly read it the first time or you did lots of improvements afterwards, but I decided to merge this PR :)

I've done a little rewording inb64dd02 after the merge (looks more major due to line breaking changes). Let me know if you think some of them are invalid.

wouterj added a commit that referenced this pull requestApr 11, 2020
* 4.4:  [#13171] Some small rewordings  [Security] Explain lazy anonymous mode
wouterj added a commit that referenced this pull requestApr 11, 2020
* 5.0:  [#13171] Some small rewordings  [Security] Explain lazy anonymous mode
@HeahDude
Copy link
ContributorAuthor

Nice :), thanks@wouterj 👍

@HeahDudeHeahDude deleted the security/anonymous branchApril 11, 2020 20:30
Sign up for freeto join this conversation on GitHub. Already have an account?Sign in to comment

Reviewers

@OskarStarkOskarStarkOskarStark left review comments

@weaverryanweaverryanAwaiting requested review from weaverryan

@wouterjwouterjAwaiting requested review from wouterj

+1 more reviewer

@chalasrchalasrchalasr approved these changes

Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Projects

None yet

Milestone

4.4

Development

Successfully merging this pull request may close these issues.

[Security] add "anonymous: lazy" mode to firewalls

5 participants

@HeahDude@wouterj@OskarStark@chalasr@carsonbot

[8]ページ先頭

©2009-2025 Movatter.jp