Problem/Motivation

See #2365319: Entity normalization should check field access to avoid leaking data

Proposed resolution

Possibly pass an ignore_field_access flag in context

Remaining tasks

Discuss if we actually want/need this. Or if people having to take control of this in an access control handler is ok

User interface changes

API changes

Comments

wim leers’s picture

Title: Consider using serializer context to bypass access » Allow to bypass access checking (using serializer context)
Version: 8.0.x-dev » 8.1.x-dev
Category: Task » Feature request
wim leers’s picture

Do we keep this feature request open indefinitely if nobody turns out to have a use case for this? Or do we mark it Closed (works as designed)? People can still find it when searching and then reopen it.

Version: 8.1.x-dev » 8.2.x-dev

Drupal 8.1.0-beta1 was released on March 2, 2016, which means new developments and disruptive changes should now be targeted against the 8.2.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

cilefen’s picture

Title: Allow to bypass access checking (using serializer context) » Allow bypassing access checking (using serializer context)
wim leers’s picture

<3 language nitpicking. Thanks for helping me improve my English!

Version: 8.2.x-dev » 8.3.x-dev

Drupal 8.2.0-beta1 was released on August 3, 2016, which means new developments and disruptive changes should now be targeted against the 8.3.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Grayside’s picture

I don't have this specific problem, but I do have issues with cache management inside normalizers. Would this flag imply some new cache tag behavior?

dawehner’s picture

I was always wondering whether the cache context could be used to put on additional cacheable metadata.

damiankloip’s picture

What would you see changing with regards to cache tags? for individual entities? What do you mean by "cache mamagement inside normalizers". Would be good to clarify that and see if everyone is on the same page.

dawehner is also talking about cacheability metadata. which should not really be a concern of the serializer itself, so are people thinking from the context (sorry!) of a REST export plugin or another REST route?

Grayside’s picture

@damiankloip as described in my comment on #2575761-7: Discuss a better system for discovering and selecting normalizers, in a normalizer I am identifying additional entities to recursively normalize into a larger data structure.

My REST resource (using the standard EntityResource for Nodes) only has cache metadata for the originally requested node. Therefore, in order to address this all I can really do is customize the rest resource to add the list cache tag. I'd rather have the option to add cache tags for just those nodes I am adding.

Version: 8.3.x-dev » 8.4.x-dev

Drupal 8.3.0-alpha1 will be released the week of January 30, 2017, which means new developments and disruptive changes should now be targeted against the 8.4.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

wim leers’s picture

Status: Active » Closed (works as designed)

#7: our normalizations are currently not cached at all. Only the actual responses are cached. So there is no risk of cache pollution.
#8: you're right, if were were to cache the results of our normalizations, we would have to add additional cache contexts. Or, rather, setting ingore_field_access would likely cause that caching to be disabled.


In more than two years, this was not once requested. I'm closing this.