Symfony: Provide message for security voter that denies access? - symfony

Question

I'm working on security for an API. Some things that I check on each request are:
Is the user's IP address whitelisted for access
Is the user's account expired
Is the user's rate limit exceeded for the day?
It seems like I should use a security Voter, perhaps one for each of these things, and return VoterInterface::ACCESS_DENIED when an access check fails.
However, I want to provide a message to the user in the API response that provides some indication as to WHY their request was denied. I cannot do this with a security voter.
My current workaround is to listen to the kernel controller event, perform my access checks, and then throw an explicit AccessDeniedException with my specific message if the check fails.
Is that a good way to handle this shortcoming? Maybe there's a way to do this within the security voter that I'm overlooking?

Answer 1

I know this is an old post but I just had the same problem and found a solution that works like a charm.
PS: I'm using symfony 3.4.4
The idea is to pass the RequestStack to the voter (constructor injection) then get the session and add a message in the flashBag to be displayed after that.
The voter constructor:
use Symfony\Component\HttpFoundation\RequestStack;
class ContactVoter extends Voter {
private $requestStack;
function __construct(RequestStack $requestStack) {
$this->requestStack= $requestStack;
}
If you are not using autowire and want to pass it as an argument in the service.yml you can use arguments: [#request_stack]
Inside the voter, the function that decide the permissions:
if ( 'Your_Access_Denied_Condition') {
$this->requestStack->getCurrentRequest()->getSession()->getFlashBag()->add('danger', 'Your message !');
return false ;
}
The template to display the message
{% if app.request.hasPreviousSession %}
{% for type, messages in app.session.flashbag.all() %}
{% for message in messages %}
<div class="alert alert-{{ type }}">
{{ message|trans({}, 'messages') }}
</div>
{% endfor %}
{% endfor %}
{% endif %}
If you dont want to use the flashBag, you can use the same logic to throw a customized exception with a specific message, catch it with a listener and display the message you want.

Answer 2

Ok I've had the same problem as you did. There is no easy way for this one you'd have to overwrite the default SecurityListener of Symfony Sensio\Bundle\FrameworkExtraBundle\EventListener\SecurityListener with something in those lines:
use Sensio\Bundle\FrameworkExtraBundle\EventListener\SecurityListener;
class MySecurityListener extends SecurityListener
{
public function onKernelController(FilterControllerEvent $event)
{
$request = $event->getRequest();
if (!$configuration = $request->attributes->get('_acme_security')) {
return;
}
// trick to simulate one security configuration (all in one class/method).
$request->attributes->set('_security', new SecurityConfiguration($configuration));
if (!$this->language->evaluate($configuration->getExpression(), $this->getVariables($request))) {
throw new AccessDeniedException(sprintf($configuration->getMessage());
}
parent::onKernelController($event);
}
}
On top of that you'll need to extend Sensio\Bundle\FrameworkExtraBundle\Configuration\Security like so:
use Sensio\Bundle\FrameworkExtraBundle\Configuration\Security as SensioSecurity;
/**
* #Annotation
*/
class Security extends SensioSecurity
{
protected $message;
public function getAliasName()
{
return 'acme_security';
}
public function getMessage()
{
return $this->message;
}
}
This above will allow you to add a message property to your controller annotation and that will be used if there is AccessDenied exception.
And here how to configure your security listener in Yaml:
acme.security.listener:
class: AppBundle\EventListener\SecurityListener
parent: sensio_framework_extra.security.listener
tags:
- { name: kernel.event_subscriber }