@secured annotation does not work with actions

[janmarek]

It seems that only signals can be protected. But I usually use render or action methods for actions which should be protected (e.g. renderDelete).

[JanTvrdik]

This is feature. Implementing support for actions would hurt performance or would require complicated caching.

[janmarek]

Ok, this is a feature request then. Why would be the caching complicated?

[JanTvrdik]

Because it is caching =) But OK, we will look into this.

[janmarek]

thank you

[janedbal]

Are you going to implement this feature?

[JanTvrdik]

@Caspern Not now, maybe one day.

[jelen07]

Hi, I have noticed, that when I have secured method handleLike($id) and I create a link for this signal, it always have the same "_sec" parameter depending on value of $id. As I'm reading above, is it due to caching? Is it really safe? I am going to replace all forms (add/delete and like/unlike table record) with nextras secured-links... is it suitable?

[JanTvrdik]

This has nothing to do with caching. It is because for each user (session) we generate a single secret token. Generating new token for every link would clutter the user's session very fast.

[jelen07]

Good to hear. Thanks for clarifications.