8000 [RFC] Show voter information in the security profiler panel · Issue #17856 · symfony/symfony · GitHub
[go: up one dir, main page]
Skip to content
8000

[RFC] Show voter information in the security profiler panel #17856

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
javiereguiluz opened this issue Feb 19, 2016 · 12 comments
Closed

[RFC] Show voter information in the security profiler panel #17856

javiereguiluz opened this issue Feb 19, 2016 · 12 comments
Labels
Feature Security WebProfilerBundle

Comments

@javiereguiluz
Copy link
Member

Problem

The security panel is not very useful because it provides little information:

security_before

Solution

Could we show at least the information about the voters that granted/rejected access? A quick-and-dirty mockup of the idea:

security_after

Questions:

  • Can this information be obtained in a reliable manner for any Symfony application?
  • Could we get inspiration from this bundle for implementing this feature? https://github.com/egulias/SecurityDebugCommandBundle
  • Do you miss any other important information in this panel?

Thanks!
@stof
Copy link
Member
stof commented Feb 19, 2016

About what would you display the votes ? There can be many decisions being taken during a page load.

@javiereguiluz
Copy link
Member Author

@stof all of them then.

@javiereguiluz
Copy link
Member Author

Sorry for the short answer. I just wonder if there is a reliable way to show what's going on regarding the security voters during a page load? (even for cases like the one you commented). Security is the most critical thing in an app and I feel that the profiler doesn't help users as much as it could.

@stof
Copy link
Member
stof commented Feb 19, 2016

@javiereguiluz displaying votes being done would require building a custom AccessDecisionManager to log decisions being made. This is quite easy to do (build a decorating implementation and wrap the service in debug mode)
Registering the vote of each voter for each decision is harder to implement (especially to correlate them with the decision)

@linaori
Copy link
Contributor
linaori commented Feb 19, 2016

What about a voter handling N attributes? Something else that could be interesting, would be to display which attributes have been voted on and what the result was:

Result Attribute Source
Granted CAN_SEE_FOO some/template/file.html.twig:50
Denied CAN_SEE_BAR SomeController:SomeAction:23
Granted IS_AUTHENTICATED_ANONYMOUSLY access_control
Denied IS_AUTHENTICATED_FULLY SomeController:SomeAction Annotation

Can easily be achieved via a backtrace in a decorator around the AuthorizationChecker using the AuthorizationCheckerInterface which will have no performance loss in prod.

In theory you can also automatically decorate voters and map their result and class. I think this feature would be more useful as the presented doesn't give me any useful information. Sure, I know which voter gave me a certain result, but that doesn't tell me where it happened and for what it happened.

@javiereguiluz
Copy link
Member Author

@iltar 👍 very nice! I like your idea.

@javiereguiluz javiereguiluz mentioned this issue Feb 22, 2016
Closed
@javiereguiluz
Copy link
Member Author

@iltar @stof in #17887 I'm trying to implement your ideas. @iltar I have no idea about how to get the Source information of your table. Any clue? Thanks!

@linaori
Copy link
Contributor
linaori commented Feb 22, 2016

@javiereguiluz this is a bit more complicated. In case of @Security annotations, you'd want to hook in on the SecurityListener in the SFWEB, for the access_control in the AccessListener and for the template I'm not entirely sure. However, for the template you should be able to somehow get the template source line numbers as this is also available when debugging.

Sadly my experience ends here. A generic solution could be to decorate the AccessDecisionManager, but then a lot of stack traces would be meaningless :(

@anacona16
Copy link

+1. I do not know how much is complicated, but it would be very useful.

@TomasVotruba
Copy link
Contributor

👍 Very nice

@robfrawley
Copy link
Contributor

Related, and touching on a few ideas that would be helpful for the purpose of this issue: #17892.

@fabpot fabpot closed this as completed Mar 4, 2016
fabpot added a commit that referenced this issue Mar 4, 2016
@fabpot
feature #17887 Show more information in the security profiler (javier…
5ebecca 
…eguiluz)

This PR was squashed before being merged into the 3.1-dev branch (closes #17887).

Discussion
----------

Show more information in the security profiler

| Q             | A
| ------------- | ---
| Bug fix?      | no
| New feature?  | yes
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | #17856
| License       | MIT
| Doc PR        | -

This is an early prototype to explore the feature of displaying more information in the security panel. Example:

![profiler_security](https://cloud.githubusercontent.com/assets/73419/13221929/0235fc46-d97e-11e5-981a-249b7148f3a6.png)

Commits
-------

b12152d Show more information in the security profiler
@tristanbes
Copy link
Contributor

👍 Very useful when debugging voters, was wondering myself why it wasn't already here last week.

ostrolucky pushed a commit to ostrolucky/symfony that referenced this issue Mar 25, 2018
@fabpot
feature symfony#17887 Show more information in the security profiler …
a25ed38 
…(javiereguiluz)

This PR was squashed before being merged into the 3.1-dev branch (closes symfony#17887).

Discussion
----------

Show more information in the security profiler

| Q             | A
| ------------- | ---
| Bug fix?      | no
| New feature?  | yes
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | symfony#17856
| License       | MIT
| Doc PR        | -

This is an early prototype to explore the feature of displaying more information in the security panel. Example:

![profiler_security](https://cloud.githubusercontent.com/assets/73419/13221929/0235fc46-d97e-11e5-981a-249b7148f3a6.png)

Commits
-------

b12152d Show more information in the security profiler
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
Feature Security WebProfilerBundle
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
8 participants
@fabpot @javiereguiluz @tristanbes @stof @TomasVotruba @linaori @anacona16 @robfrawley
0