[HttpKernel] drop the ability to configure a signer with the #[IsSignatureValid] attribute
#61756
Conversation
|
cc @santysisi |
| use Symfony\Component\HttpKernel\Tests\Fixtures\IsSignatureValidAttributeController; | ||
| use Symfony\Component\HttpKernel\Tests\Fixtures\IsSignatureValidAttributeMethodsController; | ||
|
|
||
| #[RequiresMethod(UriSigner::class, 'verify')] |
There was a problem hiding this comment.
UriSigner::verify() is available since 7.3 and HttpKernel requires 7.4+ of the HttpFoundation component
There was a problem hiding this comment.
Yeah, that was my fault, sorry about that! 🙏
OskarStark
changed the title
#[IsSignatureValid] attribute
wouterj
left a comment
wouterj
left a comment
There was a problem hiding this comment.
I agree, good catch!
I can't remember seeing requests for having multiple uri signer implementations in 1 application (nor the need to have a custom uri signer implementation). So let's make this a separate feature from the attribute.
If there is a need for this, it can always be reintroduced at a future point.
|
In my opinion, this is a good feature, giving developers the ability to choose which For context, I’ve been working in another PR Also, just as a reference, the #[AsEventListener] attribute already allows choosing a specific dispatcher via its dispatcher argument But if this cc was just to confirm the change is okay. I think it is! 👍 |
|
@santysisi it does give that flexibility, but would you have a concrete use case? We're not looking for nice to haves but for actually useful features ;) |
|
Thank you @xabbuh. |
|
@santysisi The ping was both a FYI as well as a request for comments in case you have a real world use case of which you think it's common enough to have this ability. Than you for the feedback. 👍 |
|
I've been playing with using the URI signer for stateless password reset and email verification. This could be a use case for when you would want multiple. The idea here is you would have a separate secret for each of these implementations. I admit it's not fully fleshed out yet so we can come back to it. |
|
@kbond you might want to try out the SignatureHasher class for those functions, it's what also powers the login link authenticator. |
6 participants
I would like to challenge the decision made in #60395 to support custom URI signers per usage of the new
#[IsSignatureValid]attribute. I doubt that use cases for it are so wide-spread that we need to add support for it here.