api-platform / api-platform/core

Security attribute causing 403 Forbidden Error. Cache problem?

Abierto
#8,067 0 comentarios 0 reacciones 0 asignados Ver en GitHub
doctrine Serializer State
Lenguaje dominante
PHP
Estrellas
2.6k
Forks
980
Merge medio
2 d 4 h
PR fusionados (30 d)
49

Descripción

**API Platform version(s) affected**: 3.0.8

**Description**

```
new Get(security: '(is_granted("ROLE_USER") and object.customer == user) or is_granted("ROLE_ADMIN")')
```

```
#[Orm\ManyToOne(targetEntity: Customer::class, cascade: ['persist'], inversedBy: 'appointments')]
#[JoinColumn(name: "app_cr", referencedColumnName: "cr_id")]
public ?Customer $customer = null;
```

For some hours everything runs fine. But then I'm getting 403 - Forbidden error (user/customer is correctly correctly authenticated). When I clear the cache (`php bin/console cache:clear`), everything runs again without any other changes for some hours.

Using only `security: 'is_granted("ROLE_USER")'` works fine as well.

The Customer Entity has the following security setting:

`security: '(is_granted("ROLE_USER") and object == user) or is_granted("ROLE_ADMIN")'`

And I can GET the Customer data without problem, but the call to the endpoint mentioned above fails.

**How to reproduce**

**Possible Solution**

**Additional Context**

```
System Linux dd19338 5.15.0-52-generic api-platform/api-platform#58~20.04.1-Ubuntu SMP Thu Oct 13 13:09:46 UTC 2022 x86_64
Build Date Nov 28 2022 09:57:52
Build System Linux
Server API FPM/FastCGI
Virtual Directory Support disabled
Configuration File (php.ini) Path /etc/php81/fpm
Loaded Configuration File /etc/php81/fpm/php.ini
Scan this dir for additional .ini files /etc/php81/cgi/conf.d

This program makes use of the Zend Scripting Language Engine:
Zend Engine v4.1.13, Copyright (c) Zend Technologies
with Zend OPcache v8.1.13, Copyright (c), by Zend Technologies
```

```
framework:
cache:
app: cache.adapter.apcu
```

```
-------------------- -------------------------------------------
Symfony
-------------------- -------------------------------------------
Version 6.2.2
Long-Term Support No
End of maintenance 07/2023 (in +214 days)
End of life 07/2023 (in +214 days)
-------------------- -------------------------------------------
Kernel
-------------------- -------------------------------------------
Type App\Kernel
Environment prod
Debug false
Charset UTF-8
Cache directory ./var/cache/prod (7.8 MiB)
Build directory ./var/cache/prod (7.8 MiB)
Log directory ./var/log (0 B)
-------------------- -------------------------------------------
PHP
-------------------- -------------------------------------------
Version 8.1.13
Architecture 64 bits
Intl locale de_DE
Timezone Europe/Berlin (2022-12-29T15:08:00+01:00)
OPcache true
APCu true
Xdebug false
-------------------- -------------------------------------------
```

What can cause the problem?

Guía de contribución

Abrir la guía de contribución

Evaluación

Este issue todavía no se ha evaluado.

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.