Security anyone? about notification-bundle HOT 2 CLOSED

Hi @plamenh !

The bundle is intended to be directly usable with a minimal setup. As you said, the provided controller is totally not secured and I encourage you to override it, adding your own security system.

For the ids, I recommend you to use a Uuid system. There is a great tutorial on how to implement it in Symfony : https://medium.com/@galopintitouan/auto-increment-is-the-devil-using-uuids-in-symfony-and-doctrine-71763721b9a9

This issue would be more like adding documentation on how to secure the usage

from notification-bundle.

Fair enough, I just wanted to make sure I am not missing something.

Regarding the solution - should be relatively easy in my case, as the notifiable entity is my user - just check if the notifiable entity has the same id as the user. If I get around to implementing this, I will create a tutorial. For now, though, I am sticking to an API based solution and disabling the routes.

Regarding the IDs, uuid is great, but it is overhead both in terms of system and development effort. I prefer not to use IDs at all in routes open to the public.

from notification-bundle.