8000 [Security] Improve BC-layer to deprecate eraseCredentials methods · symfony/security-core@f5f6b03 · GitHub
[go: up one dir, main page]
Skip to content

Commit f5f6b03

Browse files
nicolas-grekasnicolas-grekas
committed
[Security] Improve BC-layer to deprecate eraseCredentials methods
1 parent 1aadc21 commit f5f6b03

12 files changed

+52
-18
lines changed

‎Authentication/Token/AbstractToken.php

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -62,11 +62,11 @@ public function setUser(UserInterface $user): void
6262
/**
6363
* Removes sensitive information from the token.
6464
*
65-
* @deprecated since Symfony 7.3
65+
* @deprecated since Symfony 7.3, erase credentials using the "__serialize()" method instead
6666
*/
6767
public function eraseCredentials(): void
6868
{
69-
trigger_deprecation('symfony/security-core', '7.3', sprintf('The "%s()" method is deprecated and will be removed in 8.0, use a DTO instead or implement your own erasing logic if needed.', __METHOD__));
69+
trigger_deprecation('symfony/security-core', '7.3', \sprintf('The "%s::eraseCredentials()" method is deprecated and will be removed in 8.0, erase credentials using the "__serialize()" method instead.', TokenInterface::class));
7070

7171
if ($this->getUser() instanceof UserInterface) {
7272
$this->getUser()->eraseCredentials();

‎Authentication/Token/NullToken.php

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -44,12 +44,14 @@ public function getUserIdentifier(): string
4444
}
4545

4646
/**
47-
* Removes sensitive information from the token.
48-
*
4947
* @deprecated since Symfony 7.3
5048
*/
49+
#[\Deprecated(since: 'symfony/security-core 7.3')]
5150
public function eraseCredentials(): void
5251
{
52+
if (\PHP_VERSION_ID < 80400) {
53+
@trigger_error(\sprintf('Method %s::eraseCredentials() is deprecated since symfony/security-core 7.3', self::class), \E_USER_DEPRECATED);
54+
}
5355
}
5456

5557
public function getAttributes(): array

‎Authentication/Token/TokenInterface.php

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,9 @@
1616
/**
1717
* TokenInterface is the interface for the user authentication information.
1818
*
19+
* The __serialize/__unserialize() magic methods can be implemented on the token
20< 8000 /code>+
* class to prevent sensitive credentials from being put in the session storage.
21+
*
1922
* @author Fabien Potencier <fabien@symfony.com>
2023
* @author Johannes M. Schmitt <schmittjoh@gmail.com>
2124
*/
@@ -57,8 +60,7 @@ public function setUser(UserInterface $user): void;
5760
/**
5861
* Removes sensitive information from the token.
5962
*
60-
* @deprecated since Symfony 7.3, use a dedicated DTO instead or implement your
61-
* own erasing logic instead
63+
* @deprecated since Symfony 7.3; erase credentials using the "__serialize()" method instead
6264
*/
6365
public function eraseCredentials(): void;
6466

‎CHANGELOG.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ CHANGELOG
88
For example, users not currently logged in, or while processing a message from a message queue.
99
* Add `OfflineTokenInterface` to mark tokens that do not represent the currently logged-in user
1010
* Deprecate `UserInterface::eraseCredentials()` and `TokenInterface::eraseCredentials()`,
11-
use a dedicated DTO or erase credentials on your own e.g. upon `AuthenticationTokenCreatedEvent` instead
11+
erase credentials e.g. using `__serialize()` instead
1212

1313
7.2
1414
---

‎Tests/Authentication/AuthenticationTrustResolverTest.php

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -119,6 +119,7 @@ public function getUserIdentifier(): string
119119
{
120120
}
121121

122+
#[\Deprecated]
122123
public function eraseCredentials(): void
123124
{
124125
}

‎Tests/Authentication/Token/AbstractTokenTest.php

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@
1414
use PHPUnit\Framework\TestCase;
1515
use Symfony\Bridge\PhpUnit\ExpectDeprecationTrait;
1616
use Symfony\Component\Security\Core\Authentication\Token\AbstractToken;
17+
use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
1718
use Symfony\Component\Security\Core\User\InMemoryUser;
1819
use Symfony\Component\Security\Core\User\UserInterface;
1920

@@ -46,7 +47,8 @@ public function testEraseCredentials()
4647
$user = $this->createMock(UserInterface::class);
4748
$user->expects($this->once())->method('eraseCredentials');
4849
$token->setUser($user);
49-
$this->expectDeprecation('The Symfony\Component\Security\Core\User\UserInterface::eraseCredentials method is deprecated (since Symfony 7.3, use a dedicated DTO instead or implement your own erasing logic instead).');
50+
51+
$this->expectDeprecation(\sprintf('Since symfony/security-core 7.3: The "%s::eraseCredentials()" method is deprecated and will be removed in 8.0, erase credentials using the "__serialize()" method instead.', TokenInterface::class));
5052

5153
$token->eraseCredentials();
5254
}

‎Tests/Authentication/Token/Fixtures/CustomUser.php

< F438 div class="d-flex mr-2 flex-justify-end flex-items-center flex-1">
Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,12 @@ public function getRoles(): array
3131
return $this->roles;
3232
}
3333

34+
public function getPassword(): ?string
35+
{
36+
return null;
37+
}
38+
39+
#[\Deprecated]
3440
public function eraseCredentials(): void
3541
{
3642
}

‎Tests/User/InMemoryUserTest.php

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,11 +12,14 @@
1212
namespace Symfony\Component\Security\Core\Tests\User;
1313

1414
use PHPUnit\Framework\TestCase;
15+
use Symfony\Bridge\PhpUnit\ExpectDeprecationTrait;
1516
use Symfony\Component\Security\Core\User\InMemoryUser;
1617
use Symfony\Component\Security\Core\User\UserInterface;
1718

1819
class InMemoryUserTest extends TestCase
1920
{
21+
use ExpectDeprecationTrait;
22+
2023
public function testConstructorException()
2124
{
2225
$this->expectException(\InvalidArgumentException::class);
@@ -59,6 +62,7 @@ public function testIsEnabled()
5962
public function testEraseCredentials()
6063
{
6164
$user = new InMemoryUser('fabien', 'superpass');
65+
$this->expectDeprecation(\sprintf('%sMethod %s::eraseCredentials() is deprecated since symfony/security-core 7.3', \PHP_VERSION_ID >= 80400 ? 'Unsilenced deprecation: ' : '', InMemoryUser::class));
6266
$user->eraseCredentials();
6367
$this->assertEquals('superpass', $user->getPassword());
6468
}

‎User/InMemoryUser.php

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -74,9 +74,15 @@ public function isEnabled(): bool
7474
return $this->enabled;
7575
}
7676

77+
/**
78+
* @deprecated since Symfony 7.3
79+
*/
80+
#[\Deprecated(since: 'symfony/security-core 7.3')]
7781
public function eraseCredentials(): void
7882
{
79-
trigger_deprecation('symfony/security-core', '7.3', sprintf('The "%s()" method is deprecated and will be removed in 8.0, use a DTO instead or implement your own erasing logic if needed.', __METHOD__));
83+
if (\PHP_VERSION_ID < 80400) {
84+
@trigger_error(\sprintf('Method %s::eraseCredentials() is deprecated since symfony/security-core 7.3', self::class), \E_USER_DEPRECATED);
85+
}
8086
}
8187

8288
public function isEqualTo(UserInterface $user): bool

‎User/OidcUser.php

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -71,8 +71,15 @@ public function getUserIdentifier(): string
7171
return (string) ($this->userIdentifier ?? $this->getSub());
7272
}
7373

74+
/**
75+
* @deprecated since Symfony 7.3
76+
*/
77+
#[\Deprecated(since: 'symfony/security-core 7.3')]
7478
public function eraseCredentials(): void
7579
{
80+
if (\PHP_VERSION_ID < 80400) {
81+
@trigger_error(\sprintf('Method %s::eraseCredentials() is deprecated since symfony/security-core 7.3', self::class), \E_USER_DEPRECATED);
82+
}
7683
}
7784

7885
public function getSub(): ?string

‎User/PasswordAuthenticatedUserInterface.php

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,9 @@ interface PasswordAuthenticatedUserInterface
2323
* Returns the hashed password used to authenticate the user.
2424
*
2525
* Usually on authentication, a plain-text password will be compared to this value.
26+
*
27+
* The __serialize/__unserialize() magic methods can be implemented on the user
28+
* class to prevent hashed passwords from being put in the session storage.
2629
*/
2730
public function getPassword(): ?string;
2831
}

‎User/UserInterface.php

Lines changed: 10 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,9 @@
2424
* this interface. Objects that implement this interface are created and
2525
* loaded by different objects that implement UserProviderInterface.
2626
*
27+
* The __serialize/__unserialize() magic methods can be implemented on the user
28+
* class to prevent sensitive credentials from being put in the session storage.
29+
*
2730
* @see UserProviderInterface
2831
*
2932
* @author Fabien Potencier <fabien@symfony.com>
@@ -46,22 +49,20 @@ interface UserInterface
4649
*/
4750
public function getRoles(): array;
4851

49-
/**
50-
* Returns the identifier for this user (e.g. username or email address).
51-
*
52-
* @return non-empty-string
53-
*/
54-
public function getUserIdentifier(): string;
55-
5652
/**
5753
* Removes sensitive data from the user.
5854
*
5955
* This is important if, at any given point, sensitive information like
6056
* the plain-text password is stored on this object.
6157
*
62-
* @deprecated since Symfony 7.3, use a dedicated DTO instead or implement your
63-
* own erasing logic instead
58+
* @deprecated since Symfony 7.3, erase credentials using the "__serialize()" method instead
6459
*/
6560
public function eraseCredentials(): void;
6661

62+
/**
63+
* Returns the identifier for this user (e.g. username or email address).
64+
*
65+
* @return non-empty-string
66+
*/
67+
public function getUserIdentifier(): string;
6768
}

0 commit comments

Comments
 (0)
0