Worker reuses kernel with Security already configured #1098
Comments
|
The Symfony Runtime for FrankenPHP does call the reset method of the kernel between each request. This is most likely a service with a global state (in your app or in a 3rd party bundle such as LexikJWT) that doesn't implement the |
|
Forgive my ignorance, but I couldn't find anything that resets the kernel between requests. Only a call to I have run my app in dev env on worker mode and got this curious access decision log from one of the failed requests: My application has a total of 3 controllers - one for downloading "public" files, one for downloading "private" files, one for redirecting How come a single request checks 3 times if the user is authenticated fully, three times checks for file download permission (see different object instances - different files) and checks once for an entity that is not even a file? This voter runs only for files and requests that have _authToken query parameter. I have added below code to if ($this->kernel instanceof KernelInterface && $sfRequest && $sfResponse) {
$this->kernel->shutdown();
}Is it possible that the whole issue comes from sharing memory between requests by the worker itself? |
|
Are you talking about this Runner.php? It looks like the runtime is somehow not executing correctly or maybe your Kernel doesn't implement the Terminable Interface, I think it should though for Symfony 6.4. |
What happened?
Quick context:
Application on Symfony 6.4, Api Platform, Lexik JWT Bundle, very basic (CRUD-type) - almost default configuration.
Once deployed in production mode, my app started to behave oddly, mainly, my JWT-signed endpoints for secure file downloads started to return 403s, but only when called multiple at once.
Everything was fine on dev builds (docker target
frankenphp_dev), but once I've built onfrankenphp_prodit randomly returned 403's. If I'd hit refresh, sometimes it did load! I'd hit it again - 403, on the other hand, once the container is restarted, if I'd refresh on only a single file - it loaded fine every single time 20/20. But once I tried to load multiple files - random 403's were back.This happens only on production build, took me a couple of hours to figure it out as this is my first impression of FrankenPHP.
I use stateless firewall with Lexik JWT Bundle and this specific endpoint uses custom authenticator to resolve user from JWT token provided as query parameter. Basically this endpoint handles signed urls for downloading or displaying a file. Every request has its own username and file id combo stored in JWT payload, if the JWT signature is valid the user gets instantiated with two properties: username and file_id (and no
USER_ROLEso that the JWT cannot be used for anything else than file download).I have a
#[IsGranted()]on controller's endpoint with a complementary Voter that fetches current user instance fromSecurity::getToken()->getUser(), checks if the user is that special class instance and if it is - compares file_id of the request with the file_id stored in token's payload. This works flawlessly on dev builds and during tests.In worker mode of frankenphp, sometimes these two file_id's do not match. It is not the frontend part mixing stuff as you can hit F5 a couple of times and get different results for the exact same request and JWT token.
I figured these have to be related to
TokenStoragenot being reset between requests. But since I am very new to FrankenPhp and especially worker mode, I might be just stupid and need a guidance 😅Shouldn't Franken's runner call
service_resetterafter every request, since normally Kernel does it only onboot()?Build Type
Docker (Debian Bookworm)
Worker Mode
Yes
Operating System
GNU/Linux
CPU Architecture
x86_64
PHP configuration
Relevant log output
No response
The text was updated successfully, but these errors were encountered: