symfony/symfony — pull request #6463 by asm89 (2012-12-22 12:52:41+00:00)
Title: [WIP][RFC] Signed internal uris

Recently a security issue with the `_internal` uris of the FrameworkBundle led to the removal of the ability to directly render partials with controller actions, e.g. `{% render 'BlogBundle:Post:list' with { 'limit': 2} %}`. For me, people around me and probably other developers this mechanism was a big plus of Symfony2, because it was very easy to enable rendering these partials as `standalone` and get all the nice features of Varnish/esi.

With this pull request I propose to revert to the "old" render behavior, but only remove the `/_internal_public` route and secure the `/_internal` route by signing the url. The implementation in this PR is far from finished, but I'm looking for comments.

The complete removal of the feature should not have happened in my opinion, because not everyone relies on solely the routing firewall for security (annotations/aop, access checks in controllers, etc). Furthermore, if you do not use ESI, `_internal` uris will never be generated! Finally there are also other ways to make sure that `_internal` urls are only requested by your reverse proxy (e.g. Varnish) and are not accessible for the outside world.

There is also a POC by @fabpot that will allow for different rendering strategies if merged (#6459). The signed urls could also be a separate rendering strategy, but then it would still be useful to be able to do things like `{% render 'BlogBundle:...%}`.