diff --git a/features/authorization/deny.feature b/features/authorization/deny.feature index 7925abdb660..8aeac46c7bd 100644 --- a/features/authorization/deny.feature +++ b/features/authorization/deny.feature @@ -305,3 +305,15 @@ Feature: Authorization checking Then the response status code should be 200 And the response should contain "ownerOnlyProperty" And the response should contain "attributeBasedProperty" + + Scenario: Security post validation should be hit + When I add "Content-Type" header equal to "application/ld+json" + And I add "Authorization" header equal to "Basic ZHVuZ2xhczprZXZpbg==" + And I send a "POST" request to "/issue_6446" with body: + """ + { + "title": "" + } + """ + Then the response status code should be 403 + diff --git a/src/Symfony/Bundle/DependencyInjection/ApiPlatformExtension.php b/src/Symfony/Bundle/DependencyInjection/ApiPlatformExtension.php index aa8d20d6368..faee28f114a 100644 --- a/src/Symfony/Bundle/DependencyInjection/ApiPlatformExtension.php +++ b/src/Symfony/Bundle/DependencyInjection/ApiPlatformExtension.php @@ -958,7 +958,7 @@ private function registerSecurityConfiguration(ContainerBuilder $container, arra $loader->load('state/security.xml'); - if (interface_exists(ValidatorInterface::class) && !$config['use_symfony_listeners']) { + if (interface_exists(ValidatorInterface::class)) { $loader->load('state/security_validator.xml'); } diff --git a/tests/Fixtures/TestBundle/ApiResource/Issue6446/SecurityPostValidation.php b/tests/Fixtures/TestBundle/ApiResource/Issue6446/SecurityPostValidation.php new file mode 100644 index 00000000000..766e4e21e84 --- /dev/null +++ b/tests/Fixtures/TestBundle/ApiResource/Issue6446/SecurityPostValidation.php @@ -0,0 +1,24 @@ + + * + * For the full copyright and license information, please view the LICENSE + * file that was distributed with this source code. + */ + +declare(strict_types=1); + +namespace ApiPlatform\Tests\Fixtures\TestBundle\ApiResource\Issue6446; + +use ApiPlatform\Metadata\Post; +use Symfony\Component\Validator\Constraints\NotNull; + +#[Post(uriTemplate: 'issue_6446', securityPostValidation: 'is_granted(\'ROLE_ADMIN\')')] +class SecurityPostValidation +{ + #[NotNull] + public string $title; +}