[Security] Should we warn against complex UserInterface implementations to avoid serialization problems?

[arderyp]

As discussed with @iltar and @chalasr in symfony/symfony #27459, and as discussed by @iltar in this blog post, significant serialization problems can arise if a UserInterface implementation gets too complex.

For example, if your UserInterface object is a doctrine entity with complex relational mappings, those mappings will get serialized and may cause problems upon unserialization. I've personally experienced this first hand, and the resulting behavior was very strange, unpredictable, and difficult to debug.

Consequently, I am wondering if the official documentation should explicitly warn user's against implementing complex UserInterface objects, particularly implementations that have sub-object properties (such as an entity with relational entity/Collection properties). It might even save some headaches to go as far as to advise against database Entities implementing UserInterface and instead promote @iltar's de-coupling approach (see blog post linked above).

The two documentation pages that I thought of in relation to this issue are:

1. How to Create a custom User Provider
2. How to Load Security Users from the Database (the Entity Provider)

[javiereguiluz]

@arderyp althought I appreciate your contribution to help us improve docs, I'm afraid I'm going to close it as "won't fix" for now.

As Ryan Weaver said recently (https://twitter.com/weaverryan/status/1046915128967479298) there are no longer technical issues caused by serializing complex entities.

Of course a long-term goal is to rethink all this and do something like what Iltar proposes. But as Ryan also said, that needs a careful rethinking, a new implementation, etc. We're not there yet (although we're changing lots of things in the Security docs already: #10423). Thanks for understanding it.

[arderyp]

@javiereguiluz I'm not entirely sure I understand what @weaverryan is getting at. He suggests that what was once a problem "seems" to no longer be a problem... he "thinks". Can you/he point me to the commit that fixed said problem? He says he's not even sure why it "was" a problem... which leads me to believe there was no explicit fix that addressed it.

As I mentioned in the OP, I've experienced the problem first hand and, without seeing a commit that addresses it, I'm not sure I believe that the issue magically disappeared. That's not to say that I don't believe you or Ryan, it just seems like an oddly simple and vague statement to make about an incredibly complex issue with no commits/evidence to back it up.

Regardless, what a random thing to tweet about. Was he referencing this GitHub issue? Is this a common topic people have been discussing in the Symfony community? Bizarre.