KnowledgeHub
Questions
Tags
Users
Search
Alex Rivera
|
Logout
Edit Question
Title
Body
In our application we planned to use the RoleVoter mechanism but we'd like to remove the ROLE_ prefix as the security we are implementing is more task based than role based . Technically, there is no problem for the implementation but I found in the documentation that using the RoleVoter with an empty prefix should be discouraged . I'm wondering why? AFAICS, the only problem is that, without the prefix, the RoleVoter will participate in decisions that it is not meant to (such as the IS_AUTHENTICATED_FULLY , IS_AUTHENTICATED_REMEMBERED , ...) and might returns an access denied instead of an abstain. Could you please confirm that this is the only issue with an empty prefix? Thanks in advance M.
Tags (comma-separated)
Save Edits
Cancel