Skip to content

[SecurityHttp] Removes final keyword from IsGranted attribute #61504

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Aug 23, 2025

Conversation

crtl
Copy link
Contributor

@crtl crtl commented Aug 22, 2025

Q A
Branch? 7.4
Bug fix? no
New feature? yes
Deprecations? no
Issues Fix #60896
License MIT

Often times the same set of rules is reused many times across a project making it tedious having to manually add the attributes with their specific configuration.
Making #[IsGranted] non final allows developers to implement custom attributes like #[IsAdmin] etc. in their projects.

@crtl crtl requested a review from chalasr as a code owner August 22, 2025 18:02
@carsonbot carsonbot added this to the 7.4 milestone Aug 22, 2025
@carsonbot carsonbot changed the title Removes final keyword from IsGranted attribute Removes final keyword from IsGranted attribute Aug 22, 2025
Copy link
Member

@chalasr chalasr left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks sensible to me

@crtl crtl changed the title Removes final keyword from IsGranted attribute [SecurityHttp] Removes final keyword from IsGranted attribute Aug 22, 2025
@fabpot
Copy link
Member

fabpot commented Aug 23, 2025

Thank you @crtl.

@stof
Copy link
Member

stof commented Aug 25, 2025

This won't work.

The API used by the IsGrantedAttributeListener does not support using attributes of a child class, so this feature is broken.
Actual support for child classes needs to be added if the class is not final (otherwise, removing the final keyword is only about introducing confusing non-working cases)

@derrabus
Copy link
Member

@stof is right. Let's revert the PR. If we want to un-finalize IsGranted, we need to make further adjustments and add tests that cover custome IsGranted attributes.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

[Security] Make IsGranted Attribute non final to allow usage of custom attributes
6 participants