#54060·symfony

Cleanup AccessDecisionManager

Author: homersimpsonsCreated Feb 26, 2024Updated Sep 15, 2026
LabelsSecurity

Description

While looking at the VoterInterface::vote function, it was rather hard to figure out why $attributes is an array (and what is it expected to contain): https://github.com/symfony/symfony/blob/de93ccde2a1be2a46dbc6e10d5541a0f07e22e33/src/Symfony/Component/Security/Core/Authorization/Voter/VoterInterface.php#L38

It looks like this should be removed since Symfony 6.0: https://github.com/symfony/symfony/blob/de93ccde2a1be2a46dbc6e10d5541a0f07e22e33/src/Symfony/Component/Security/Core/Authorization/AccessDecisionManager.php#L54

I could not find any issue about this in the backlog.

I think it is also the time to update $attributes to a string, but that is a breaking change. This may not be possible, see https://github.com/symfony/symfony/issues/54060#issuecomment-2333729570.

Example

php
interface VoterInterface
{
    public function vote(TokenInterface $token, mixed $subject, string $attribute): int;
}