SymfonyWorld Online 2021 Winter Edition December 9 – 10, 2021 100% Online +20 talks and workshops

New in Symfony 5.4: Faster Security Voters

Symfony 5.4 is backed by Private Packagist. Private Packagist is a fast, reliable, and secure Composer repository for your private packages. It mirrors all your open-source dependencies for better availability and monitors them for security vulnerabilities.

Contributed by
Jérémy Derussé
in #43066.

Security Voters are the recommended way to check for permissions in Symfony applications. They allow to centralize the permission logic so you can reuse it from controllers, templates and services.

During runtime, whenever Symfony finds a isGranted() method call, it iterates over all the voters, and stops when the configured access decision strategy is met. This works well in most applications, but it hurts performance in some scenarios.

Consider a backend that displays a listing of 20 entities, each of them showing 6 properties and 3 actions (e.g. edit, show, delete). If you want to check permissions for accessing those properties and running those actions, you are calling each voter 20 x (6 + 3) = 180 times. If you have 5 voters, that's 900 calls.

Most of the times voters only care about a certain permission/attribute (e.g. EDIT_BLOG_POST or APPROVE_EXTRA_DISCOUNT) or a certain object type (e.g. User or Invoice). That makes voters cacheable and that's why we're introducing the following CacheableVoterInterface in Symfony 5.4:

1
2
3
4
5
6
7
8
9
namespace Symfony\Component\Security\Core\Authorization\Voter;

interface CacheableVoterInterface extends VoterInterface
{
    public function supportsAttribute(string $attribute): bool;

    // $subjectType is the value returned by `get_class($subject)` or `get_debug_type($subject)`
    public function supportsType(string $subjectType): bool;
}

If your voter returns false in any (or all) of those methods, Symfony will cache that result and your voter won't be called again for that attribute/permission and/or type.

When your voter extends the abstract Voter class, there's no need to implement the new interface explicitly because that parent class already does it for you. Instead, you only need to override the supportsAttribute() and/or supportsType() methods.

For example, if your voter supports several object types but all attribute/permission names follow the APROVE_* pattern, do this:

1
2
3
4
5
6
7
8
9
10
11
12
13
namespace App\Security;

use Symfony\Component\Security\Core\Authorization\Voter\Voter;

class MyVoter extends Voter
{
    public function supportsAttribute(string $attribute): bool
    {
        return str_starts_with($attribute, 'APPROVE_');
    }

    // ...
}

If your voter supports many different attributes/permissions on some specific type, use this:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
namespace App\Security;

use App\Entity\BlogPost;
use Symfony\Component\Security\Core\Authorization\Voter\Voter;

class MyVoter extends Voter
{
    public function supportsType(string $subjectType): bool
    {
        // you can't use a simple BlogPost::class === $subjectType comparison
        // here because the given subject type could be the proxy class used
        // by Doctrine when creating the entity object
        return is_a($subjectType, BlogPost::class, true);
    }

    // ...
}

Thanks to this change, in a real application that defines 40 voters which are called 500 times via isGranted(), we measured a 40% performance improvement in the handling of security authorization. If you measure the improvement in your apps (e.g. using Blackfire.io) don't forget to share the results in the comments below.

Help the Symfony project!

As with any Open-Source project, contributing code or documentation is the most common way to help, but we also have a wide range of sponsoring opportunities.

Comments

so cool. thank you!
Great change!
Nice 👍
Very good feature! Thank you.
NEAT!
Thanks Jérémy
Very nice. Thank you :)
Great! In the last example, why we can not use instanceof instead is_a() ?
@DanielSentker because "$subjectType" is a string. You can only use instanceof on object instances.
There is a mistake in the last example: `is_a($subjectType, BlogPost, true);` => `is_a($subjectType, BlogPost::class, true);`
Login with SymfonyConnect to post a comment