8000 [Security][SecurityBundle] Deprecate the HTTP digest auth · symfony/symfony@11fe79d · GitHub
[go: up one dir, main page]
Skip to content

Commit 11fe79d

Browse files
ogizanagiogizanagi
committed
[Security][SecurityBundle] Deprecate the HTTP digest auth
1 parent 477a24d commit 11fe79d

22 files changed

+453
-9
lines changed

‎UPGRADE-3.4.md

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -252,6 +252,13 @@ Profiler
252252

253253
* The `profiler.matcher` option has been deprecated.
254254

255+
Security
256+
--------
257+
258+
* Deprecated the HTTP digest authentication: `NonceExpiredException`,
259+
`DigestAuthenticationListener` and `DigestAuthenticationEntryPoint` will be
260+
removed in 4.0. Use another authentication system like `http_basic` instead.
261+
255262
SecurityBundle
256263
--------------
257264

@@ -272,6 +279,9 @@ SecurityBundle
272279
* Added `logout_on_user_change` to the firewall options. This config item will
273280
trigger a logout when the user has changed. Should be set to true to avoid
274281
deprecations in the configuration.
282+
283+
* Deprecated the HTTP digest authentication: `HttpDigestFactory` will be removed in 4.0.
284+
Use another authentication system like `http_basic` instead.
275285

276286
Translation
277287
-----------

‎UPGRADE-4.0.md

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -645,6 +645,10 @@ Security
645645
* Calling `ContextListener::setLogoutOnUserChange(false)` won't have any
646646
effect anymore.
647647

648+
* Removed the HTTP digest authentication system. The `NonceExpiredException`,
649+
`DigestAuthenticationListener` and `DigestAuthenticationEntryPoint` classes
650+
have been removed. Use another authentication system like `http_basic` instead.
651+
648652
SecurityBundle
649653
--------------
650654

@@ -665,6 +669,9 @@ SecurityBundle
665669

666670
* The firewall option `logout_on_user_change` is now always true, which will
667671
trigger a logout if the user changes between requests.
672+
673+
* Removed the HTTP digest authentication system. The `HttpDigestFactory` class
674+
has been removed. Use another authentication system like `http_basic` instead.
668675

669676
Serializer
670677
----------

‎src/Symfony/Bundle/SecurityBundle/CHANGELOG.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@ CHANGELOG
1616
* Added `logout_on_user_change` to the firewall options. This config item will
1717
trigger a logout when the user has changed. Should be set to true to avoid
1818
deprecations in the configuration.
19+
* deprecated HTTP digest authentication
1920

2021
3.3.0
2122
-----

‎src/Symfony/Bundle/SecurityBundle/DependencyInjection/Security/Factory/HttpDigestFactory.php

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,9 +20,18 @@
2020
* HttpDigestFactory creates services for HTTP digest authentication.
2121
*
2222
* @author Fabien Potencier <fabien@symfony.com>
23+
*
24+
* @deprecated since 3.4, to be removed in 4.0
2325
*/
2426
class HttpDigestFactory implements SecurityFactoryInterface
2527
{
28+
public function __construct($triggerDeprecation = true)
29+
{
30+
if ($triggerDeprecation) {
31+
@trigger_error(sprintf('The %s class and the whole HTTP digest authentication system is deprecated since 3.4 and will be removed in 4.0.', __CLASS__), E_USER_DEPRECATED);
32+
}
33+
}
34+
2635
public function create(ContainerBuilder $container, $id, $config, $userProvider, $defaultEntryPoint)
2736
{
2837
$provider = 'security.authentication.provider.dao.'.$id;
@@ -59,6 +68,7 @@ public function getKey()
5968
public function addConfiguration(NodeDefinition $node)
6069
{
6170
$node
71+
->setDeprecated('The HTTP digest authentication is deprecated since 3.4 and will be removed in 4.0.')
6272
->children()
6373
->scalarNode('provider')->end()
6474
->scalarNode('realm')->defaultValue('Secured Area')->end()

‎src/Symfony/Bundle/SecurityBundle/SecurityBundle.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,7 @@ public function build(ContainerBuilder $container)
4747
$extension->addSecurityListenerFactory(new JsonLoginFactory());
4848
$extension->addSecurityListenerFactory(new HttpBasicFactory());
4949
$extension->addSecurityListenerFactory(new HttpBasicLdapFactory());
50-
$extension->addSecurityListenerFactory(new HttpDigestFactory());
50+
$extension->addSecurityListenerFactory(new HttpDigestFactory(false));
5151
$extension->addSecurityListenerFactory(new RememberMeFactory());
5252
$extension->addSecurityListenerFactory(new X509Factory());
5353
$extension->addSecurityListenerFactory(new RemoteUserFactory());

‎src/Symfony/Bundle/SecurityBundle/Tests/DependencyInjection/CompleteConfigurationTest.php

Lines changed: 125 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -86,6 +86,131 @@ public function testFirewalls()
8686
$configs[0][2] = strtolower($configs[0][2]);
8787
$configs[2][2] = strtolower($configs[2][2]);
8888

89+
$this->assertEquals(array(
90+
array(
91+
'simple',
92+
'security.user_checker',
93+
'security.request_matcher.6tndozi',
94+
false,
95+
),
96 E377 +
array(
97+
'secure',
98+
'security.user_checker',
99+
null,
100+
true,
101+
true,
102+
'security.user.provider.concrete.default',
103+
null,
104+
'security.authentication.form_entry_point.secure',
105+
null,
106+
null,
107+
array(
108+
'logout',
109+
'switch_user',
110+
'x509',
111+
'remote_user',
112+
'form_login',
113+
'http_basic',
114+
'remember_me',
115+
'anonymous',
116+
),
117+
array(
118+
'parameter' => '_switch_user',
119+
'role' => 'ROLE_ALLOWED_TO_SWITCH',
120+
),
121+
),
122+
array(
123+
'host',
124+
'security.user_checker',
125+
'security.request_matcher.and0kk1',
126+
true,
127+
false,
128+
'security.user.provider.concrete.default',
129+
'host',
130+
'security.authentication.basic_entry_point.host',
131+
null,
132+
null,
133+
array(
134+
'http_basic',
135+
'anonymous',
136+
),
137+
null,
138+
),
139+
array(
140+
'with_user_checker',
141+
'app.user_checker',
142+
null,
143+
true,
144+
false,
145+
'security.user.provider.concrete.default',
146+
'with_user_checker',
147+
'security.authentication.basic_entry_point.with_user_checker',
148+
null,
149+
null,
150+
array(
151+
'http_basic',
152+
'anonymous',
153+
),
154+
null,
155+
),
156+
), $configs);
157+
158+
$this->assertEquals(array(
159+
array(),
160+
array(
161+
'security.channel_listener',
162+
'security.logout_listener.secure',
163+
'security.authentication.listener.x509.secure',
164+
'security.authentication.listener.remote_user.secure',
165+
'security.authentication.listener.form.secure',
166+
'security.authentication.listener.basic.secure',
167+
'security.authentication.listener.rememberme.secure',
168+
'security.authentication.listener.anonymous.secure',
169+
'security.authentication.switchuser_listener.secure',
170+
'security.access_listener',
171+
),
172+
array(
173+
'security.channel_listener',
174+
'security.context_listener.0',
175+
'security.authentication.listener.basic.host',
176+
'security.authentication.listener.anonymous.host',
177+
'security.access_listener',
178+
),
179+
array(
180+
'security.channel_listener',
181+
'security.context_listener.1',
182+
'security.authentication.listener.basic.with_user_checker',
183+
'security.authentication.listener.anonymous.with_user_checker',
184+
'security.access_listener',
185+
),
186+
), $listeners);
187+
188+
$this->assertFalse($container->hasAlias('Symfony\Component\Security\Core\User\UserCheckerInterface', 'No user checker alias is registered when custom user checker services are registered'));
189+
}
190+
191+
/**
192+
* @group legacy
193+
*/
194+
public function testFirewallsWithDigest()
195+
{
196+
$container = $this->getContainer('container1_with_digest');
197+
$arguments = $container->getDefinition('security.firewall.map')->getArguments();
198+
$listeners = array();
199+
$configs = array();
200+
foreach (array_keys($arguments[1]->getValues()) as $contextId) {
201+
$contextDef = $container->getDefinition($contextId);
202+
$arguments = $contextDef->getArguments();
203+
$listeners[] = array_map('strval', $arguments['index_0']->getValues());
204+
205+
$configDef = $container->getDefinition((string) $arguments['index_2']);
206+
$configs[] = array_values($configDef->getArguments());
207+
}
208+
209+
// the IDs of the services are case sensitive or insensitive depending on
210+
// the Symfony version. Transform them to lowercase to simplify tests.
211+
$configs[0][2] = strtolower($configs[0][2]);
212+
$configs[2][2] = strtolower($configs[2][2]);
213+
89214
$this->assertEquals(array(
90215
array(
91216
'simple',

‎src/Symfony/Bundle/SecurityBundle/Tests/DependencyInjection/Fixtures/php/container1.php

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -64,7 +64,6 @@
6464
'simple' => array('pattern' => '/login', 'security' => false),
6565
'secure' => array('stateless' => true,
6666
'http_basic' => true,
67-
'http_digest' => array('secret' => 'TheSecret'),
6867
'form_login' => true,
6968
'anonymous' => true,
7069
10000 'switch_user' => true,

‎src/Symfony/Bundle/SecurityBundle/Tests/DependencyInjection/Fixtures/php/container1_with_digest.php

Lines changed: 105 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,105 @@
1+
<?php
2+
3+
$container->loadFromExtension('security', array(
4+
'acl' => array(),
5+
'encoders' => array(
6+
'JMS\FooBundle\Entity\User1' => 'plaintext',
7+
'JMS\FooBundle\Entity\User2' => array(
8+
'algorithm' => 'sha1',
9+
'encode_as_base64' => false,
10+
'iterations' => 5,
11+
),
12+
'JMS\FooBundle\Entity\User3' => array(
13+
'algorithm' => 'md5',
14+
),
15+
'JMS\FooBundle\Entity\User4' => array(
16+
'id' => 'security.encoder.foo',
17+
),
18+
'JMS\FooBundle\Entity\User5' => array(
19+
'algorithm' => 'pbkdf2',
20+
'hash_algorithm' => 'sha1',
21+
'encode_as_base64' => false,
22+
'iterations' => 5,
23+
'key_length' => 30,
24+
),
25+
'JMS\FooBundle\Entity\User6' => array(
26+
'algorithm' => 'bcrypt',
27+
'cost' => 15,
28+
),
29+
),
30+
'providers' => array(
31+
'default' => array(
32+
'memory' => array(
33+
'users' => array(
34+
'foo' => array('password' => 'foo', 'roles' => 'ROLE_USER'),
35+
),
36+
),
37+
),
38+
'digest' => array(
39+
'memory' => array(
40+
'users' => array(
41+
'foo' => array('password' => 'foo', 'roles' => 'ROLE_USER, ROLE_ADMIN'),
42+
),
43+
),
44+
),
45+
'basic' => array(
46+
'memory' => array(
47+
'users' => array(
48+
'foo' => array('password' => '0beec7b5ea3f0fdbc95d0dd47f3c5bc275da8a33', 'roles' => 'ROLE_SUPER_ADMIN'),
49+
'bar' => array('password' => '0beec7b5ea3f0fdbc95d0dd47f3c5bc275da8a33', 'roles' => array('ROLE_USER', 'ROLE_ADMIN')),
50+
),
51+
),
52+
),
53+
'service' => array(
54+
'id' => 'user.manager',
55+
),
56+
'chain' => array(
57+
'chain' => array(
58+
'providers' => array('service', 'basic'),
59+
),
60+
),
61+
),
62+
63+
'firewalls' => array(
64+
'simple' => array('pattern' => '/login', 'security' => false),
65+
'secure' => array('stateless' => true,
66+
'http_basic' => true,
67+
'http_digest' => array('secret' => 'TheSecret'),
68+
'form_login' => true,
69+
'anonymous' => true,
70+
'switch_user' => true,
71+
'x509' => true,
72+
'remote_user' => true,
73+
'logout' => true,
74+
'remember_me' => array('secret' => 'TheSecret'),
75+
'user_checker' => null,
76+
'logout_on_user_change' => true,
77+
),
78+
'host' => array(
79+
'pattern' => '/test',
80+
'host' => 'foo\\.example\\.org',
81+
'methods' => array('GET', 'POST'),
82+
'anonymous' D7AE => true,
83+
'http_basic' => true,
84+
'logout_on_user_change' => true,
85+
),
86+
'with_user_checker' => array(
87+
'user_checker' => 'app.user_checker',
88+
'anonymous' => true,
89+
'http_basic' => true,
90+
'logout_on_user_change' => true,
91+
),
92+
),
93+
94+
'access_control' => array(
95+
array('path' => '/blog/524', 'role' => 'ROLE_USER', 'requires_channel' => 'https', 'methods' => array('get', 'POST')),
96+
array('path' => '/blog/.*', 'role' => 'IS_AUTHENTICATED_ANONYMOUSLY'),
97+
array('path' => '/blog/524', 'role' => 'IS_AUTHENTICATED_ANONYMOUSLY', 'allow_if' => "token.getUsername() matches '/^admin/'"),
98+
),
99+
100+
'role_hierarchy' => array(
101+
'ROLE_ADMIN' => 'ROLE_USER',
102+
'ROLE_SUPER_ADMIN' => array('ROLE_USER', 'ROLE_ADMIN', 'ROLE_ALLOWED_TO_SWITCH'),
103+
'ROLE_REMOTE' => 'ROLE_USER,ROLE_ADMIN',
104+
),
105+
));

‎src/Symfony/Bundle/SecurityBundle/Tests/DependencyInjection/Fixtures/php/no_custom_user_checker.php

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,6 @@
1515
'secure' => array(
1616
'stateless' => true,
1717
'http_basic' => true,
18-
'http_digest' => array('secret' => 'TheSecret'),
1918
'form_login' => true,
2019
'anonymous' => true,
2120
'switch_user' => true,

‎src/Symfony/Bundle/SecurityBundle/Tests/DependencyInjection/Fixtures/xml/container1.xml

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,6 @@
4949

5050
<firewall name="secure" stateless="true">
5151
<http-basic />
52-
<http-digest secret="TheSecret" />
5352
<form-login />
5453
<anonymous />
5554
<switch-user />

0 commit comments

Comments
 (0)
0