-1

I have the following config/packages/security.yml file and it really looks like follows:

framework:
    rate_limiter:
        username_ip_login:
            policy: token_bucket
            limit: 5
            rate: { interval: '5 minutes' }

        ip_login:
            policy: sliding_window
            limit: 50
            interval: '15 minutes'

    services:
        app.login_rate_limiter:
            class: Symfony\Component\Security\Http\RateLimiter\DefaultLoginRateLimiter
            arguments:
                $globalFactory: '@limiter.ip_login'
                $localFactory: '@limiter.username_ip_login'

    security:
        enable_authenticator_manager: true
        password_hashers:
            App\Entity\User:
                algorithm: auto

        providers:
            app_user_provider:
                entity:
                    class: App\Entity\User
                    property: email
        firewalls:
            dev:
                pattern: ^/(_(profiler|wdt)|css|images|js)/
                security: false
                login_throttling:
                    max_attempts: 3
                    interval: '15 minutes'
                    limiter: app.login_rate_limiter
            main:
                lazy: true
                provider: app_user_provider
                login_throttling:
                    max_attempts: 3
                    interval: '15 minutes'
                    limiter: app.login_rate_limiter
                json_login:
                    check_path: /login
                    username_path: email
                    password_path: password
                custom_authenticators: 
                    - App\Security\TokenAuthenticator
                entry_point: App\Security\EntryPointAuth
                stateless: true

        access_control:
            - { path: ^/profile, roles: ROLE_USER }
            - { path: ^/books, roles: ROLE_USER }

And here is my controller:

<?php

namespace App\Controller;

use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
use Symfony\Component\HttpFoundation\JsonResponse;
use Symfony\Component\Routing\Annotation\Route;
use Symfony\Component\HttpFoundation\Response;
use Symfony\Component\Serializer\SerializerInterface;

class ProfileController extends AbstractController
{

    private SerializerInterface $serializer;

    public function __construct(SerializerInterface $serializer)
    {
        $this->serializer = $serializer;
    }

    #[Route('/profile', name: 'get_profile', methods: ["GET"])]
    public function index(): JsonResponse
    {
        $user = $this->getUser();

        $result = $this->serializer->serialize($user, 'json', ['groups' => ['read']]);

        return JsonResponse::fromJsonString($result);
    }

    #[Route("/profile", name: "update_profile", methods: ["PUT"])]
    public function update(): JsonResponse
    {
        echo 2;
        exit;
    }
}

Now it succeeds when I hit GET /profile But when I hit PUT /profile to update, it gives me 410 unauthorized response.

I use access token stateless implementation for security and the protected endpoint GET /profile is working perfectly, why PUT /profile is not working even if I use the same token for both endpoints?

Any ideas? Will be appreciated.

Mostafa A. Hamid
  • 65
  • 10
  • What have you tried to resolve the problem? Where are you stuck? Does your application's log file provide more details? – Nico Haase Aug 16 '21 at 13:34
  • The problem is those 2 protected routes 1 PUT and 1 GET, the GET route is working properly without any problems using the access token as you can see in the controller, but the PUT route when I hit it with the same access token, and I get 410 unauthorized. – Mostafa A. Hamid Aug 16 '21 at 18:52
  • Here are some logs: The GET request succeeds as follows: [Web Server ] Aug 16 20:59:56 |INFO | SERVER GET (200) /profile ip="::1" But the PUT request fails as follows: [Web Server ] Aug 16 20:59:50 |WARN | SERVER PUT (401) /profile host="127.0.0.1:8004" ip="::1" scheme="https" – Mostafa A. Hamid Aug 16 '21 at 19:00
  • Thanks @NicoHaase I found the solution – Mostafa A. Hamid Aug 16 '21 at 19:27

1 Answers1

0

I got to manage it working by changing the PUT route to profile/update instead of just profile because it makes a conflict. I think it is a bug in Symfony that needs to be addressed.

Or you need to change the access control route to /profile to the following:

- { path: ^/profile, roles: ROLE_USER, methods: [GET, PUT] }
Mostafa A. Hamid
  • 65
  • 10