[HttpFoundation] Add `#[IsSignatureValid]` attribute by santysisi · Pull Request #60395 · symfony/symfony

santysisi · 2025-05-09T21:24:34Z

Q	A
Branch?	7.4
Bug fix?	no
New feature?	yes
Deprecations?	no
Issues	Feature #60189
License	MIT

✨ New Feature: `#[IsSignatureValid]` Attribute

This attribute enables declarative signature validation on controller actions. It ensures that requests using specific HTTP methods are validated using UriSigner. If the signature is invalid, a SignedUriException is thrown.

✅ Usage Examples

#[IsSignatureValid] // Applies to all HTTP methods by default
public function someAction(): Response

#[IsSignatureValid(methods: ['POST', 'PUT'])] // Only validates POST and PUT requests
public function updateAction(): Response

#[IsSignatureValid(signer: 'my_custom_signer_service')] // Uses a custom UriSigner service
public function customSignedAction(): Response

santysisi · 2025-05-09T22:43:16Z

Hi 👋
I'll update this version 7.3 to 7.4 once the new minor dev version is released.

Edit: I updated this version to 7.3 because I need this method from UriSigner.

src/Symfony/Component/Security/Http/EventListener/IsSignatureValidAttributeListener.php

kbond · 2025-05-12T13:45:53Z

This is looking great @santysisi! I'll give it a more thorough review after 7.3 is released.

santysisi · 2025-05-19T04:37:22Z

We could also consider adding an extra argument to the attribute called methods to restrict the validation to specific HTTP methods. This would align with the current behavior of the IsCsrfTokenValid attribute.

santysisi · 2025-05-30T03:40:30Z

We could also consider adding an extra argument to the attribute called methods to restrict the validation to specific HTTP methods. This would align with the current behavior of the IsCsrfTokenValid attribute.

Hi 👋 I'll update this version 7.3 to 7.4 once the new minor dev version is released.

Edit: I updated this version to 7.3 because I need this method from UriSigner.

ready these 2 changes 🚀

kbond

This looks really great, nice work @santysisi!

santysisi · 2025-06-05T01:26:36Z

I believe the error is not relevant 🤔
I only rebased the branch to resolve some conflicts, so there shouldn't be any functional changes introduced.

src/Symfony/Bundle/SecurityBundle/composer.json

src/Symfony/Component/Security/Http/Attribute/IsSignatureValid.php

src/Symfony/Component/Security/Http/composer.json

kbond · 2025-07-15T19:26:12Z

Awesome, let's wait for some others to take a look. As I said, I think tagged services is the way to go but maybe someone has a different idea.

alexander-schranz · 2025-07-18T06:54:54Z

I did not go over all comments, but for me it looks false this live inside Security namespace.

The UriSigner I can use currently without any SecurityBundle / Security services, so from my point of view the attribute should work also without any security related service and be more part of the FrameworkBundle like the UriSigner service itself.

santysisi · 2025-07-19T19:45:47Z

I did not go over all comments, but for me it looks false this live inside Security namespace.

The UriSigner I can use currently without any SecurityBundle / Security services, so from my point of view the attribute should work also without any security related service and be more part of the FrameworkBundle like the UriSigner service itself.

Hi 👋 First of all, thank you very much for your comment 😊

You're right. When I started working on this feature, I saw this new attribute as something similar to IsGranted or IsCsrfTokenValid, which is why I initially placed it in the symfony/security-http component and the symfony/security-bundle bundle.

However, you're right that UriSigner resides in the symfony/http-foundation component and can be used without the symfony/security-bundle or any other security components. Therefore, it would make more sense for this attribute to reside in HttpFoundation and be part of the FrameworkBundle instead of the SecurityBundle.

Thanks again for the comment!

What do you think, @kbond?

kbond · 2025-07-21T14:20:28Z

Yeah, this is a good point. I wonder if http-kernel would be the better spot? This component has other controller-related attributes/listeners.

alexander-schranz · 2025-07-21T14:45:03Z

@kbond HttpKernel sounds good for me if I look at the attributes there: https://github.com/symfony/symfony/tree/7.4/src/Symfony/Component/HttpKernel/Attribute

santysisi · 2025-07-21T22:42:14Z

Moved the attribute to the HttpKernel component 😄

stof · 2025-09-10T17:29:38Z

src/Symfony/Component/HttpKernel/Attribute/IsSignatureValid.php

+#[\Attribute(\Attribute::IS_REPEATABLE | \Attribute::TARGET_CLASS | \Attribute::TARGET_METHOD | \Attribute::TARGET_FUNCTION)]
+final class IsSignatureValid
+{
+    public readonly array $methods;


Please add the phpdoc @var string[] to properly document the public API

fabpot · 2025-09-14T08:10:32Z

Thank you @santysisi.

… the `#[IsSignatureValid]` attribute (xabbuh) This PR was merged into the 7.4 branch. Discussion ---------- [HttpKernel] drop the ability to configure a signer with the `#[IsSignatureValid]` attribute | Q | A | ------------- | --- | Branch? | 7.4 | Bug fix? | no | New feature? | no | Deprecations? | no | Issues | | License | MIT I would like to challenge the decision made in #60395 to support custom URI signers per usage of the new `#[IsSignatureValid]` attribute. I doubt that use cases for it are so wide-spread that we need to add support for it here. Commits ------- 7fafe69 drop the ability to configure a signer with the IsSignatureValid attribute

santysisi requested a review from chalasr as a code owner May 9, 2025 21:24

carsonbot added Status: Needs Review Feature HttpFoundation labels May 9, 2025

carsonbot added this to the 7.3 milestone May 9, 2025

santysisi force-pushed the feature/verify-signature-attribute branch 5 times, most recently from 4730169 to c72ef83 Compare May 9, 2025 22:27

94noni reviewed May 10, 2025

View reviewed changes

src/Symfony/Component/Security/Http/EventListener/IsSignatureValidAttributeListener.php Show resolved Hide resolved

santysisi force-pushed the feature/verify-signature-attribute branch from c72ef83 to 85320cf Compare May 18, 2025 03:00

fabpot modified the milestones: 7.3, 7.4 May 26, 2025

santysisi force-pushed the feature/verify-signature-attribute branch from 85320cf to c000b69 Compare May 29, 2025 23:01

kbond approved these changes May 30, 2025

View reviewed changes

carsonbot added Status: Reviewed and removed Status: Needs Review labels May 30, 2025

santysisi force-pushed the feature/verify-signature-attribute branch from c000b69 to 24fca48 Compare June 4, 2025 00:50

santysisi mentioned this pull request Jun 4, 2025

[HttpFoundation] Add documentation for #[IsSignatureValid] attribute symfony/symfony-docs#21041

Merged

santysisi force-pushed the feature/verify-signature-attribute branch from 24fca48 to 524b686 Compare June 5, 2025 00:50

nicolas-grekas reviewed Jun 5, 2025

View reviewed changes

src/Symfony/Bundle/SecurityBundle/composer.json Outdated Show resolved Hide resolved

nicolas-grekas reviewed Jun 5, 2025

View reviewed changes

src/Symfony/Component/Security/Http/Attribute/IsSignatureValid.php Outdated Show resolved Hide resolved

nicolas-grekas reviewed Jun 5, 2025

View reviewed changes

src/Symfony/Component/Security/Http/Attribute/IsSignatureValid.php Outdated Show resolved Hide resolved

nicolas-grekas reviewed Jun 5, 2025

View reviewed changes

src/Symfony/Component/Security/Http/composer.json Outdated Show resolved Hide resolved

santysisi force-pushed the feature/verify-signature-attribute branch 2 times, most recently from a7d8c95 to 1d8202c Compare July 15, 2025 13:25

santysisi force-pushed the feature/verify-signature-attribute branch from 1d8202c to d2ff216 Compare July 17, 2025 22:47

santysisi mentioned this pull request Jul 17, 2025

Attribute for UriSigned controllers #61149

Closed

santysisi force-pushed the feature/verify-signature-attribute branch from d2ff216 to 35cbbc0 Compare July 18, 2025 22:42

santysisi force-pushed the feature/verify-signature-attribute branch from 35cbbc0 to 0c3ec83 Compare July 21, 2025 22:06

santysisi changed the title ~~[HttpFoundation] Add #[IsSignatureValid] attribute~~ [HttpKernel] Add #[IsSignatureValid] attribute Jul 21, 2025

santysisi force-pushed the feature/verify-signature-attribute branch from 0c3ec83 to 5b0b74e Compare July 21, 2025 22:43

santysisi force-pushed the feature/verify-signature-attribute branch from 5b0b74e to c304021 Compare August 16, 2025 23:30

stof reviewed Sep 10, 2025

View reviewed changes

fabpot approved these changes Sep 14, 2025

View reviewed changes

carsonbot added Status: Reviewed and removed Status: Needs Review labels Sep 14, 2025

carsonbot changed the title ~~[HttpKernel] Add #[IsSignatureValid] attribute~~ [HttpFoundation] Add #[IsSignatureValid] attribute Sep 14, 2025

[HttpKernel] Add #[IsSignatureValid] attribute

b3a992d

fabpot force-pushed the feature/verify-signature-attribute branch from c304021 to b3a992d Compare September 14, 2025 08:10

fabpot merged commit 9fd4503 into symfony:7.4 Sep 14, 2025
5 of 12 checks passed

fabpot mentioned this pull request Sep 14, 2025

[HttpFoundation] Add #[IsSignatureValid] attribute symfony/symfony-docs#21373

Closed

santysisi mentioned this pull request Sep 15, 2025

[HttpFoundation] Add UriSignerInterface #61747

Closed

xabbuh mentioned this pull request Sep 15, 2025

[HttpKernel] drop the ability to configure a signer with the #[IsSignatureValid] attribute #61756

Merged

This was referenced Oct 27, 2025

Release v7.4.0-BETA1 #62172

Merged

Release v8.0.0-BETA1 #62173

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[HttpFoundation] Add `#[IsSignatureValid]` attribute#60395

[HttpFoundation] Add `#[IsSignatureValid]` attribute#60395
fabpot merged 1 commit intosymfony:7.4from
santysisi:feature/verify-signature-attribute

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

10 participants

Uh oh!

Conversation

Uh oh!

✨ New Feature: #[IsSignatureValid] Attribute

✅ Usage Examples

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

10 participants

✨ New Feature: `#[IsSignatureValid]` Attribute