[HttpKernel] Deprecate X-Status-Code for better alternative #19822

jameshalsall · 2016-09-02T09:49:07Z

Q	A
Branch?	master
Bug fix?	no
New feature?	yes
BC breaks?	no
Deprecations?	yes
Tests pass?	yes
Fixed tickets	#12343
License	MIT
Doc PR	symfony/symfony-docs#6948

This marks the X-Status-Code header method of setting a custom response status
code in exception listeners for a better alternative. There is now a new method
on the GetResponseForExceptionEvent that allows successful status codes in
the response sent to the client.

The old method of setting the X-Status-Code header will now throw a deprecation warning.

Instead, in your exception listener you simply call GetResponseForExceptionEvent::allowCustomResponseCode() which will tell the Kernel not to override the status code of the event's response object.

Currenty the X-Status-Code header will still be removed, so as not to change the existing behaviour, but this is something we can remove in 4.0.

TODO:

Replace usage of X-Status-Code in FormAuthenticationEntryPoint
Open Silex issue
Rename method on the response
Ensure correct response code is set in AuthenticationEntryPointInterface implementations
Ensure the exception listeners are marking GetResponseForExceptionEvent as allowing a custom response code
In the Security component we should only use the new method of setting a custom response code if it is available, and fall back to the X-Status-Code method

jameshalsall · 2016-09-02T12:34:55Z

src/Symfony/Component/Security/Http/EntryPoint/FormAuthenticationEntryPoint.php

@@ -54,7 +54,7 @@ public function start(Request $request, AuthenticationException $authException =

            $response = $this->httpKernel->handle($subRequest, HttpKernelInterface::SUB_REQUEST);
            if (200 === $response->getStatusCode()) {
-                $response->headers->set('X-Status-Code', 401);
+                $response->setStatusCode(401);


@fabpot I'm not sure about this change, in the authentication listeners found in the Symfony\Component\Security\Http\Firewall namespace the response returned from the AuthenticationEntryPointInterface::start() method is set on the response. From what I can see the X-Status-Code is only ever used when handling the exception in the kernel, so I don't think this will have any adverse impact

@fabpot interested on hearing your thoughts on the above? would be good to get this into 3.2 before the development window closes

This looks suspicious to me. You are saying that this can basically be removed, right? If that's the case, we probably need to understand what changed between the time the PR adding this was merged and now.

stloyd · 2016-09-02T14:44:29Z

src/Symfony/Component/HttpKernel/Event/GetResponseForExceptionEvent.php

    public function __construct(HttpKernelInterface $kernel, Request $request, $requestType, \Exception $e)
    {
        parent::__construct($kernel, $request, $requestType);

        $this->setException($e);
+        $this->allowSuccessfulResponse = false;


This should be set on variable declaration not in construct.

jameshalsall · 2016-09-02T16:45:12Z

The build failure in AppVeyor is not look related to these changes.

lemoinem · 2016-09-28T01:34:12Z

@jameshalsall If you could rebase your PR so the Conflict can be resolved, I think we could switch this to Reviewed!

jameshalsall · 2016-09-28T07:54:37Z

Rebased.

lemoinem · 2016-09-28T12:15:31Z

Status: Reviewed

xabbuh · 2016-10-14T09:20:54Z

src/Symfony/Component/HttpKernel/Event/GetResponseForExceptionEvent.php

+    /**
+     * @var bool
+     */
+    private $allowSuccessfulResponse = false;


Why did you choose this name? This feature is not limited to successful response codes, is it?

Good point - I used this as it was proposed in the original issue, but I'll re-name it to something more appropriate.

@xabbuh updated this now to allowCustomResponseCode

fabpot · 2016-10-24T19:25:35Z

Some notes from my research about this (I wanted to understand why it was not used more in Symfony itself):

The special X-Status-Code header was added in 788e5eb to fix HttpKernel BC break silexphp/Silex#438. So Silex documentation should be updated as this is documented here: silexphp/Silex@902c374
The only use case in Symfony itself was added later on via [Security] Return 401 when using use_forward for form authentication #6957

fabpot · 2017-02-16T14:41:04Z

@jameshalsall Do you have time to finish this one?

jameshalsall · 2017-02-17T09:41:13Z

@fabpot I will get to this early next week - it's completely slipped my mind

jameshalsall · 2017-02-20T22:46:15Z

@fabpot this is ready for re-review now

fabpot · 2017-02-22T16:53:28Z

src/Symfony/Component/HttpKernel/HttpKernel.php

@@ -242,10 +242,12 @@ private function handleException(\Exception $e, $request, $type)

        // the developer asked for a specific status code
        if ($response->headers->has('X-Status-Code')) {
+            @trigger_error(sprintf('Using the X-Status-Code header is deprecated, use %s::allowCustomResponseCode() instead.', GetResponseForExceptionEvent::class), E_USER_DEPRECATED);


should be is deprecated since version 3.3 and will be removed in 4.0. Use ...

fabpot · 2017-02-22T16:56:33Z

src/Symfony/Component/Security/Http/Firewall/ExceptionListener.php

@@ -112,6 +112,9 @@ private function handleAuthenticationException(GetResponseForExceptionEvent $eve

        try {
            $event->setResponse($this->startAuthentication($event->getRequest(), $exception));
+            if (method_exists($event, 'allowCustomResponseCode')) {


The condition should be removed and composer.json (both for symfony/security and symfony/security-http) should be updated to only allow symfony/http-kernel 3.3+. The reason is that you are using setStatusCode above anyway, so the code only works for patched versions oh http-kernel.

fabpot · 2017-02-22T16:56:41Z

src/Symfony/Component/Security/Http/Firewall/ExceptionListener.php

@@ -155,6 +158,9 @@ private function handleAccessDeniedException(GetResponseForExceptionEvent $event
                $subRequest->attributes->set(Security::ACCESS_DENIED_ERROR, $exception);

                $event->setResponse($event->getKernel()->handle($subRequest, HttpKernelInterface::SUB_REQUEST, true));
+                if (method_exists($event, 'allowCustomResponseCode')) {


Condition should be removed

fabpot · 2017-02-22T16:57:20Z

src/Symfony/Component/Security/Http/Tests/Firewall/ExceptionListenerTest.php

@@ -110,7 +117,12 @@ public function testAccessDeniedExceptionFullFledgedAndWithoutAccessDeniedHandle
        $listener = $this->createExceptionListener(null, $this->createTrustResolver(true), $httpUtils, null, '/error');
        $listener->onKernelException($event);

-        $this->assertEquals('error', $event->getResponse()->getContent());
+        if (method_exists($event, 'isAllowingCustomResponseCode')) {


Condition can be removed

fabpot · 2017-02-22T16:58:35Z

src/Symfony/Component/Security/Http/Tests/Firewall/ExceptionListenerTest.php

        $listener->onKernelException($event);

-        $this->assertEquals('OK', $event->getResponse()->getContent());
+        if (method_exists($event, 'isAllowingCustomResponseCode')) {


can be removed

fabpot · 2017-02-22T17:00:13Z

Also, we need to work on a PR on Silex to be sure that the code proposed here works there as well.

This marks the X-Status-Code header method of setting a custom response status code in exception listeners as deprecated. Instead there is now a new method on the GetResponseForExceptionEvent that allows successful status codes in the response sent to the client.

fabpot · 2017-03-01T06:52:21Z

Thank you @jameshalsall.

fabpot · 2017-03-01T06:52:48Z

@jameshalsall Can you finish the PR for Silex? Thanks.

…ative (jameshalsall) This PR was merged into the 3.3-dev branch. Discussion ---------- [HttpKernel] Deprecate X-Status-Code for better alternative | Q | A | | --- | --- | | Branch? | master | | Bug fix? | no | | New feature? | yes | | BC breaks? | no | | Deprecations? | yes | | Tests pass? | yes | | Fixed tickets | #12343 | | License | MIT | | Doc PR | symfony/symfony-docs#6948 | This marks the X-Status-Code header method of setting a custom response status code in exception listeners for a better alternative. There is now a new method on the `GetResponseForExceptionEvent` that allows successful status codes in the response sent to the client. The old method of setting the X-Status-Code header will now throw a deprecation warning. Instead, in your exception listener you simply call `GetResponseForExceptionEvent::allowCustomResponseCode()` which will tell the Kernel not to override the status code of the event's response object. Currenty the `X-Status-Code` header will still be removed, so as not to change the existing behaviour, but this is something we can remove in 4.0. TODO: - [x] Replace usage of X-Status-Code in `FormAuthenticationEntryPoint` - [x] Open Silex issue - [x] Rename method on the response - [x] Ensure correct response code is set in `AuthenticationEntryPointInterface` implementations - [x] Ensure the exception listeners are marking `GetResponseForExceptionEvent` as allowing a custom response code - [x] In the Security component we should only use the new method of setting a custom response code if it is available, and fall back to the `X-Status-Code` method Commits ------- cc0ef28 [HttpKernel] Deprecate X-Status-Code for better alternative

iisisrael · 2017-06-28T00:29:47Z

As a result of this change, PhpUnit functional tests no longer recognize redirects on ACL exceptions. When authenticated as a user without the required role, this fails:

$this->assertEquals(Response::HTTP_FORBIDDEN, $client->getResponse()->getStatusCode());

Functional tests have to resort to confirming that the response content matches the expected redirect page (e.g. the home page) instead of the tested forbidden page's content. This can also be seen in debug mode in the Symfony profiler - the HTTP status is 200, though a Sub Request exists with an AccessDeniedException.

Either of these changes to Symfony\Component\HttpKernel\HttpKernel::handleException() resolves the unnoticed sub request, and the only visible change on the front end is the HTTP response code (restored to a 403 as before instead of a 200):

-         } elseif (!$event->isAllowingCustomResponseCode() && !$response->isClientError() && !$response->isServerError() && !$response->isRedirect()) {
+         } elseif (!$response->isClientError() && !$response->isServerError() && !$response->isRedirect()) {

or:

-         } elseif (!$event->isAllowingCustomResponseCode() && !$response->isClientError() && !$response->isServerError() && !$response->isRedirect()) {
+         } elseif ((!$event->isAllowingCustomResponseCode() && !$response->isClientError() && !$response->isServerError() && !$response->isRedirect())
+             || ($event->isAllowingCustomResponseCode() && $e->getStatusCode() === Response::HTTP_FORBIDDEN)
+         ) {

I can't tell what the original intent was for the change in this particular instance, so I'm not sure which would be preferred.

… handler (jameshalsall) This PR was submitted for the master branch but it was merged into the 3.3 branch instead (closes #6948). Discussion ---------- Update docs for setting custom response code in exception handler Docs update for the changes applied in symfony/symfony#19822 Commits ------- 5f0becf Update docs for setting custom response code in exception handler

…obrev) This PR was merged into the 2.3.x-dev branch. Discussion ---------- Allow setting custom status code on exception response Closes #1450. Prior and related PRs and issues: - symfony/symfony#19822 - symfony/symfony-docs@5f0becf - symfony/symfony-docs#9336 Commits ------- 7103511 Allow setting custom status code on exception response

…Code Introduced in 5f0becf The functionality was introduced in symfony/symfony#19822. The method got renamed during code review, but was not updated in the docs. symfony/symfony#19822 (comment)

…onseCode (hkdobrev) This PR was submitted for the master branch but it was merged into the 3.4 branch instead (closes #9336). Discussion ---------- Rename allowSuccessfulResponse to correct allowCustomResponseCode Introduced in 5f0becf The functionality was introduced in symfony/symfony#19822. The method got renamed during code review, but was not updated in the docs. symfony/symfony#19822 (comment) Commits ------- 0cda0d5 Rename missing allowCustomResponseCode to correct allowCustomResponseCode

carsonbot added Status: Needs Review HttpKernel Feature Deprecation labels Sep 2, 2016

jameshalsall force-pushed the deprecate-x-status-code-header branch 2 times, most recently from b742e97 to 2eae976 Compare September 2, 2016 10:24

jameshalsall mentioned this pull request Sep 2, 2016

Update docs for setting custom response code in exception handler symfony/symfony-docs#6948

Closed

jameshalsall changed the title ~~[HttpKernel] Deprecate X-Status-Code for better alternative~~ [WIP][HttpKernel] Deprecate X-Status-Code for better alternative Sep 2, 2016

jameshalsall force-pushed the deprecate-x-status-code-header branch from 2eae976 to 001c2da Compare September 2, 2016 12:28

jameshalsall reviewed Sep 2, 2016
View reviewed changes

jameshalsall force-pushed the deprecate-x-status-code-header branch from 001c2da to 75d9d7c Compare September 2, 2016 12:36

jameshalsall changed the title ~~[WIP][HttpKernel] Deprecate X-Status-Code for better alternative~~ [WIP][HttpKernel] Deprecate X-Status-Code for better alternativ Sep 2, 2016

jameshalsall changed the title ~~[WIP][HttpKernel] Deprecate X-Status-Code for better alternativ~~ [HttpKernel] Deprecate X-Status-Code for better alternativ Sep 2, 2016

jameshalsall changed the title ~~[HttpKernel] Deprecate X-Status-Code for better alternativ~~ [HttpKernel] Deprecate X-Status-Code for better alternative Sep 2, 2016

stloyd reviewed Sep 2, 2016
View reviewed changes

jameshalsall force-pushed the deprecate-x-status-code-header branch from 75d9d7c to 703108f Compare September 2, 2016 14:54

jameshalsall force-pushed the deprecate-x-status-code-header branch from 703108f to cbcc2b4 Compare September 6, 2016 09:34

jameshalsall force-pushed the deprecate-x-status-code-header branch from cbcc2b4 to 51e8614 Compare September 28, 2016 07:54

carsonbot added Status: Reviewed and removed Status: Needs Review labels Sep 28, 2016

xabbuh reviewed Oct 14, 2016

View reviewed changes

jameshalsall force-pushed the deprecate-x-status-code-header branch 2 times, most recently from 0c17566 to 96a8caa Compare October 15, 2016 21:22

nicolas-grekas added this to the 3.x milestone Dec 6, 2016

jameshalsall force-pushed the deprecate-x-status-code-header branch 5 times, most recently from f9ce498 to 6dbf9f7 Compare February 20, 2017 22:33

fabpot reviewed Feb 22, 2017

View reviewed changes

jameshalsall force-pushed the deprecate-x-status-code-header branch from 6dbf9f7 to 01595e0 Compare February 23, 2017 18:43

jameshalsall force-pushed the deprecate-x-status-code-header branch from 01595e0 to cc0ef28 Compare February 23, 2017 21:30

fabpot merged commit cc0ef28 into symfony:master Mar 1, 2017

nicolas-grekas modified the milestones: 3.x, 3.3 Mar 24, 2017

fabpot mentioned this pull request May 1, 2017

Release v3.3.0-BETA1 #22603

Merged

This was referenced Feb 25, 2018

Rename allowSuccessfulResponse to correct allowCustomResponseCode symfony/symfony-docs#9336

Closed

Allow setting custom status code on exception response silexphp/Silex#1613

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[HttpKernel] Deprecate X-Status-Code for better alternative #19822

[HttpKernel] Deprecate X-Status-Code for better alternative #19822

jameshalsall commented Sep 2, 2016 •

edited

Loading

jameshalsall Sep 2, 2016

jameshalsall Sep 20, 2016

fabpot Oct 24, 2016

stloyd Sep 2, 2016

jameshalsall commented Sep 2, 2016

lemoinem commented Sep 28, 2016

jameshalsall commented Sep 28, 2016

lemoinem commented Sep 28, 2016

xabbuh Oct 14, 2016

jameshalsall Oct 15, 2016

jameshalsall Oct 15, 2016

fabpot commented Oct 24, 2016

fabpot commented Feb 16, 2017

jameshalsall commented Feb 17, 2017

jameshalsall commented Feb 20, 2017

fabpot Feb 22, 2017

fabpot Feb 22, 2017

fabpot Feb 22, 2017

fabpot Feb 22, 2017

fabpot Feb 22, 2017

fabpot commented Feb 22, 2017

fabpot commented Mar 1, 2017

fabpot commented Mar 1, 2017

iisisrael commented Jun 28, 2017

[HttpKernel] Deprecate X-Status-Code for better alternative #19822

[HttpKernel] Deprecate X-Status-Code for better alternative #19822

Conversation

jameshalsall commented Sep 2, 2016 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jameshalsall commented Sep 2, 2016

lemoinem commented Sep 28, 2016

jameshalsall commented Sep 28, 2016

lemoinem commented Sep 28, 2016

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

fabpot commented Oct 24, 2016

fabpot commented Feb 16, 2017

jameshalsall commented Feb 17, 2017

jameshalsall commented Feb 20, 2017

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

fabpot commented Feb 22, 2017

fabpot commented Mar 1, 2017

fabpot commented Mar 1, 2017

iisisrael commented Jun 28, 2017

jameshalsall commented Sep 2, 2016 •

edited

Loading