Contributed by
Jérémy Derussé
in #43066.
Security Voters are the recommended way to check for permissions in Symfony applications. They allow to centralize the permission logic so you can reuse it from controllers, templates and services.
During runtime, whenever Symfony finds a isGranted()
method call, it iterates
over all the voters, and stops when the configured access decision strategy is met.
This works well in most applications, but it hurts performance in some scenarios.
Consider a backend that displays a listing of 20 entities, each of them showing
6 properties and 3 actions (e.g. edit
, show
, delete
). If you want to
check permissions for accessing those properties and running those actions, you are
calling each voter 20 x (6 + 3) = 180 times. If you have 5 voters, that's 900 calls.
Most of the times voters only care about a certain permission/attribute (e.g.
EDIT_BLOG_POST
or APPROVE_EXTRA_DISCOUNT
) or a certain object type (e.g.
User
or Invoice
). That makes voters cacheable and that's why we're
introducing the following CacheableVoterInterface
in Symfony 5.4:
1 2 3 4 5 6 7 8 9
namespace Symfony\Component\Security\Core\Authorization\Voter;
interface CacheableVoterInterface extends VoterInterface
{
public function supportsAttribute(string $attribute): bool;
// $subjectType is the value returned by `get_class($subject)` or `get_debug_type($subject)`
public function supportsType(string $subjectType): bool;
}
If your voter returns false
in any (or all) of those methods, Symfony will
cache that result and your voter won't be called for that attribute/permission
and/or type. For example, if your voter supports several object types but all
attribute/permission names follow the APROVE_*
pattern, do this:
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19
namespace App\Security;
use Symfony\Component\Security\Core\Authorization\Voter\CacheableVoterInterface;
use Symfony\Component\Security\Core\Authorization\Voter\Voter;
class MyVoter extends Voter implements CacheableVoterInterface
{
public function supportsAttribute(string $attribute): bool
{
return str_starts_with($attribute, 'APPROVE_');
}
public function supportsType(string $subjectType): bool
{
return true;
}
// ...
}
If your voter supports many different attributes/permissions on some specific type, use this:
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20
namespace App\Security;
use App\Entity\BlogPost;
use Symfony\Component\Security\Core\Authorization\Voter\CacheableVoterInterface;
use Symfony\Component\Security\Core\Authorization\Voter\Voter;
class MyVoter extends Voter implements CacheableVoterInterface
{
public function supportsAttribute(string $attribute): bool
{
return true;
}
public function supportsType(string $subjectType): bool
{
return BlogPost::class === $subjectType;
}
// ...
}
Thanks to this change, in a real application that defines 40 voters and they are
called 500 times via isGranted()
, we measured a 40% performance improvement
in the handling of security authorization. If you measure the improvement in your
apps (e.g. using Blackfire.io) don't forget to share the results in the comments below.
What a Symfony developer should know about the framework: News, Jobs, Tweets, Events, Videos,...