Skip to content

Commit ad3faaf

Browse files
wouterjfabpot
wouterj
authored and
fabpot
committed
[Security] Deprecate AnonymousToken, non-UserInterface users, and token credentials
1 parent cb19eb1 commit ad3faaf

14 files changed

+37
-26
lines changed

‎Authenticator/FormLoginAuthenticator.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -120,7 +120,7 @@ public function createAuthenticatedToken(PassportInterface $passport, string $fi
120120
*/
121121
public function createToken(Passport $passport, string $firewallName): TokenInterface
122122
{
123-
return new UsernamePasswordToken($passport->getUser(), null, $firewallName, $passport->getUser()->getRoles());
123+
return new UsernamePasswordToken($passport->getUser(), $firewallName, $passport->getUser()->getRoles());
124124
}
125125

126126
public function onAuthenticationSuccess(Request $request, TokenInterface $token, string $firewallName): ?Response

‎Authenticator/JsonLoginAuthenticator.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -122,7 +122,7 @@ public function createAuthenticatedToken(PassportInterface $passport, string $fi
122122

123123
public function createToken(Passport $passport, string $firewallName): TokenInterface
124124
{
125-
return new UsernamePasswordToken($passport->getUser(), null, $firewallName, $passport->getUser()->getRoles());
125+
return new UsernamePasswordToken($passport->getUser(), $firewallName, $passport->getUser()->getRoles());
126126
}
127127

128128
public function onAuthenticationSuccess(Request $request, TokenInterface $token, string $firewallName): ?Response

‎Controller/UserValueResolver.php

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,7 @@ public function supports(Request $request, ArgumentMetadata $argument): bool
4949
$user = $token->getUser();
5050

5151
// in case it's not an object we cannot do anything with it; E.g. "anon."
52+
// @deprecated since 5.4
5253
return $user instanceof UserInterface;
5354
}
5455

‎EventListener/UserCheckerListener.php

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,7 @@ public function preCheckCredentials(CheckPassportEvent $event): void
4646
public function postCheckCredentials(AuthenticationSuccessEvent $event): void
4747
{
4848
$user = $event->getAuthenticationToken()->getUser();
49+
// @deprecated since 5.4, $user will always be an UserInterface instance
4950
if (!$user instanceof UserInterface) {
5051
return;
5152
}

‎Firewall/SwitchUserListener.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -190,7 +190,7 @@ private function attemptSwitchUser(Request $request, string $username): ?TokenIn
190190
$roles = $user->getRoles();
191191
$roles[] = 'ROLE_PREVIOUS_ADMIN';
192192
$originatedFromUri = str_replace('/&', '/?', preg_replace('#[&?]'.$this->usernameParameter.'=[^&]*#', '', $request->getRequestUri()));
193-
$token = new SwitchUserToken($user, $user->getPassword(), $this->firewallName, $roles, $token, $originatedFromUri);
193+
$token = new SwitchUserToken($user, $this->firewallName, $roles, $token, $originatedFromUri);
194194

195195
if (null !== $this->dispatcher) {
196196
$switchEvent = new SwitchUserEvent($request, $token->getUser(), $token);

‎Logout/LogoutUrlGenerator.php

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -132,6 +132,7 @@ private function getListener(?string $key): array
132132
if (null !== $this->tokenStorage) {
133133
$token = $this->tokenStorage->getToken();
134134

135+
// @deprecated since 5.4
135136
if ($token instanceof AnonymousToken) {
136137
throw new \InvalidArgumentException('Unable to generate a logout url for an anonymous token.');
137138
}

‎Tests/Authentication/AuthenticatorManagerTest.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -159,7 +159,7 @@ public function testAllRequiredBadgesPresent()
159159
$csrfBadge = new CsrfTokenBadge('csrfid', 'csrftoken');
160160
$csrfBadge->markResolved();
161161
$authenticator->expects($this->any())->method('authenticate')->willReturn(new SelfValidatingPassport(new UserBadge('wouter'), [$csrfBadge]));
162-
$authenticator->expects($this->any())->method('createToken')->willReturn(new UsernamePasswordToken($this->user, null, 'main'));
162+
$authenticator->expects($this->any())->method('createToken')->willReturn(new UsernamePasswordToken($this->user, 'main'));
163163

164164
$authenticator->expects($this->once())->method('onAuthenticationSuccess');
165165

‎Tests/Authenticator/RememberMeAuthenticatorTest.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@ protected function setUp(): void
3838

3939
public function testSupportsTokenStorageWithToken()
4040
{
41-
$this->tokenStorage->setToken(new UsernamePasswordToken('username', 'credentials', 'main'));
41+
$this->tokenStorage->setToken(new UsernamePasswordToken(new InMemoryUser('username', 'credentials'), 'main'));
4242

4343
$this->assertFalse($this->authenticator->supports(Request::create('/')));
4444
}

‎Tests/Controller/UserValueResolverTest.php

Lines changed: 8 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@
1818
use Symfony\Component\HttpKernel\ControllerMetadata\ArgumentMetadata;
1919
use Symfony\Component\Security\Core\Authentication\Token\Storage\TokenStorage;
2020
use Symfony\Component\Security\Core\Authentication\Token\UsernamePasswordToken;
21+
use Symfony\Component\Security\Core\User\InMemoryUser;
2122
use Symfony\Component\Security\Core\User\UserInterface;
2223
use Symfony\Component\Security\Http\Attribute\CurrentUser;
2324
use Symfony\Component\Security\Http\Controller\UserValueResolver;
@@ -36,7 +37,7 @@ public function testResolveNoToken()
3637
public function testResolveNoUser()
3738
{
3839
$mock = $this->createMock(UserInterface::class);
39-
$token = new UsernamePasswordToken('username', 'password', 'provider');
40+
$token = new UsernamePasswordToken(new InMemoryUser('username', 'password'), 'provider');
4041
$tokenStorage = new TokenStorage();
4142
$tokenStorage->setToken($token);
4243

@@ -57,8 +58,8 @@ public function testResolveWrongType()
5758

5859
public function testResolve()
5960
{
60-
$user = $this->createMock(UserInterface::class);
61-
$token = new UsernamePasswordToken($user, 'password', 'provider');
61+
$user = new InMemoryUser('username', 'password');
62+
$token = new UsernamePasswordToken($user, 'provider');
6263
$tokenStorage = new TokenStorage();
6364
$tokenStorage->setToken($token);
6465

@@ -71,8 +72,8 @@ public function testResolve()
7172

7273
public function testResolveWithAttribute()
7374
{
74-
$user = $this->createMock(UserInterface::class);
75-
$token = new UsernamePasswordToken($user, 'password', 'provider');
75+
$user = new InMemoryUser('username', 'password');
76+
$token = new UsernamePasswordToken($user, 'provider');
7677
$tokenStorage = new TokenStorage();
7778
$tokenStorage->setToken($token);
7879

@@ -87,7 +88,6 @@ public function testResolveWithAttribute()
8788
public function testResolveWithAttributeAndNoUser()
8889
{
8990
$tokenStorage = new TokenStorage();
90-
$tokenStorage->setToken(new UsernamePasswordToken('username', 'password', 'provider'));
9191

9292
$resolver = new UserValueResolver($tokenStorage);
9393
$metadata = new ArgumentMetadata('foo', null, false, false, null, false, [new CurrentUser()]);
@@ -97,8 +97,8 @@ public function testResolveWithAttributeAndNoUser()
9797

9898
public function testIntegration()
9999
{
100-
$user = $this->createMock(UserInterface::class);
101-
$token = new UsernamePasswordToken($user, 'password', 'provider');
100+
$user = new InMemoryUser('username', 'password');
101+
$token = new UsernamePasswordToken($user, 'provider');
102102
$tokenStorage = new TokenStorage();
103103
$tokenStorage->setToken($token);
104104

@@ -108,9 +108,7 @@ public function testIntegration()
108108

109109
public function testIntegrationNoUser()
110110
{
111-
$token = new UsernamePasswordToken('username', 'password', 'provider');
112111
$tokenStorage = new TokenStorage();
113-
$tokenStorage->setToken($token);
114112

115113
$argumentResolver = new ArgumentResolver(null, [new UserValueResolver($tokenStorage), new DefaultValueResolver()]);
116114
$this->assertSame([null], $argumentResolver->getArguments(Request::create('/'), function (UserInterface $user = null) {}));

‎Tests/EventListener/UserCheckerListenerTest.php

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -66,11 +66,14 @@ public function testPostAuthValidCredentials()
6666
$this->listener->postCheckCredentials(new AuthenticationSuccessEvent(new PostAuthenticationToken($this->user, 'main', [])));
6767
}
6868

69+
/**
70+
* @group legacy
71+
*/
6972
public function testPostAuthNoUser()
7073
{
7174
$this->userChecker->expects($this->never())->method('checkPostAuth');
7275

73-
$this->listener->postCheckCredentials(new AuthenticationSuccessEvent(new PreAuthenticatedToken('nobody', null, 'main')));
76+
$this->listener->postCheckCredentials(new AuthenticationSuccessEvent(new PreAuthenticatedToken('nobody', 'main')));
7477
}
7578

7679
private function createCheckPassportEvent($passport = null)

‎Tests/Firewall/AccessListenerTest.php

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -307,7 +307,7 @@ public function testHandleWhenPublicAccessIsAllowed()
307307

308308
public function testHandleWhenPublicAccessWhileAuthenticated()
309309
{
310-
$token = new UsernamePasswordToken(new InMemoryUser('Wouter', null, ['ROLE_USER']), null, 'main', ['ROLE_USER']);
310+
$token = new UsernamePasswordToken(new InMemoryUser('Wouter', null, ['ROLE_USER']), 'main', ['ROLE_USER']);
311311
$tokenStorage = new TokenStorage();
312312
$tokenStorage->setToken($token);
313313
$request = new Request();
@@ -347,7 +347,7 @@ public function testHandleMWithultipleAttributesShouldBeHandledAsAnd()
347347
->willReturn([['foo' => 'bar', 'bar' => 'baz'], null])
348348
;
349349

350-
$authenticatedToken = new UsernamePasswordToken('test', 'test', 'test', ['ROLE_USER']);
350+
$authenticatedToken = new UsernamePasswordToken(new InMemoryUser('test', 'test', ['ROLE_USER']), 'test', ['ROLE_USER']);
351351

352352
$tokenStorage = new TokenStorage();
353353
$tokenStorage->setToken($authenticatedToken);

‎Tests/Firewall/ContextListenerTest.php

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -63,7 +63,7 @@ public function testUserProvidersNeedToImplementAnInterface()
6363
public function testOnKernelResponseWillAddSession()
6464
{
6565
$session = $this->runSessionOnKernelResponse(
66-
new UsernamePasswordToken('test1', 'pass1', 'phpunit'),
66+
new UsernamePasswordToken(new InMemoryUser('test1', 'pass1'), 'phpunit'),
6767
null
6868
);
6969

@@ -75,7 +75,7 @@ public function testOnKernelResponseWillAddSession()
7575
public function testOnKernelResponseWillReplaceSession()
7676
{
7777
$session = $this->runSessionOnKernelResponse(
78-
new UsernamePasswordToken('test1', 'pass1', 'phpunit'),
78+
new UsernamePasswordToken(new InMemoryUser('test1', 'pass1'), 'phpunit'),
7979
'C:10:"serialized"'
8080
);
8181

@@ -94,6 +94,9 @@ public function testOnKernelResponseWillRemoveSession()
9494
$this->assertFalse($session->has('_security_session'));
9595
}
9696

97+
/**
98+
* @group legacy
99+
*/
97100
public function testOnKernelResponseWillRemoveSessionOnAnonymousToken()
98101
{
99102
$session = $this->runSessionOnKernelResponse(new AnonymousToken('secret', 'anon.'), 'C:10:"serialized"');
@@ -104,7 +107,7 @@ public function testOnKernelResponseWillRemoveSessionOnAnonymousToken()
104107
public function testOnKernelResponseWithoutSession()
105108
{
106109
$tokenStorage = new TokenStorage();
107-
$tokenStorage->setToken(new UsernamePasswordToken('test1', 'pass1', 'phpunit'));
110+
$tokenStorage->setToken(new UsernamePasswordToken(new InMemoryUser('test1', 'pass1'), 'phpunit'));
108111
$request = new Request();
109112
$request->attributes->set('_security_firewall_run', '_security_session');
110113
$session = new Session(new MockArraySessionStorage());
@@ -299,7 +302,7 @@ public function testDeauthenticatedEvent()
299302

300303
$user = new InMemoryUser('foo', 'bar');
301304
$session = new Session(new MockArraySessionStorage());
302-
$session->set('_security_context_key', serialize(new UsernamePasswordToken($user, '', 'context_key', ['ROLE_USER'])));
305+
$session->set('_security_context_key', serialize(new UsernamePasswordToken($user, 'context_key', ['ROLE_USER'])));
303306

304307
$request = new Request();
305308
$request->setSession($session);
@@ -403,7 +406,7 @@ private function handleEventWithPreviousSession($userProviders, UserInterface $u
403406
{
404407
$tokenUser = $user ?? new InMemoryUser('foo', 'bar');
405408
$session = new Session(new MockArraySessionStorage());
406-
$session->set('_security_context_key', serialize(new UsernamePasswordToken($tokenUser, '', 'context_key', ['ROLE_USER'])));
409+
$session->set('_security_context_key', serialize(new UsernamePasswordToken($tokenUser, 'context_key', ['ROLE_USER'])));
407410

408411
$request = new Request();
409412
$request->setSession($session);

‎Tests/Logout/LogoutUrlGeneratorTest.php

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@
1717
use Symfony\Component\Security\Core\Authentication\Token\AnonymousToken;
1818
use Symfony\Component\Security\Core\Authentication\Token\Storage\TokenStorage;
1919
use Symfony\Component\Security\Core\Authentication\Token\UsernamePasswordToken;
20+
use Symfony\Component\Security\Core\User\InMemoryUser;
2021
use Symfony\Component\Security\Http\Logout\LogoutUrlGenerator;
2122

2223
/**
@@ -57,12 +58,15 @@ public function testGetLogoutPathWithoutLogoutListenerRegisteredForKeyThrowsExce
5758

5859
public function testGuessFromToken()
5960
{
60-
$this->tokenStorage->setToken(new UsernamePasswordToken('user', 'password', 'secured_area'));
61+
$this->tokenStorage->setToken(new UsernamePasswordToken(new InMemoryUser('user', 'password'), 'secured_area'));
6162
$this->generator->registerListener('secured_area', '/logout', null, null);
6263

6364
$this->assertSame('/logout', $this->generator->getLogoutPath());
6465
}
6566

67+
/**
68+
* @group legacy
69+
*/
6670
public function testGuessFromAnonymousTokenThrowsException()
6771
{
6872
$this->expectException(\InvalidArgumentException::class);
@@ -90,7 +94,7 @@ public function testGuessFromCurrentFirewallContext()
9094

9195
public function testGuessFromTokenWithoutFirewallNameFallbacksToCurrentFirewall()
9296
{
93-
$this->tokenStorage->setToken(new UsernamePasswordToken('username', 'password', 'provider'));
97+
$this->tokenStorage->setToken(new UsernamePasswordToken(new InMemoryUser('username', 'password'), 'provider'));
9498
$this->generator->registerListener('secured_area', '/logout', null, null);
9599
$this->generator->setCurrentFirewall('secured_area');
96100

‎composer.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@
1818
"require": {
1919
"php": ">=7.2.5",
2020
"symfony/deprecation-contracts": "^2.1",
21-
"symfony/security-core": "^5.3|^6.0",
21+
"symfony/security-core": "^5.4|^6.0",
2222
"symfony/http-foundation": "^5.3|^6.0",
2323
"symfony/http-kernel": "^5.3|^6.0",
2424
"symfony/polyfill-mbstring": "~1.0",

0 commit comments

Comments
 (0)