8000 bug #36176 [Security] Check if firewall is stateless before checking … · symfony/symfony@881fa02 · GitHub
[go: up one dir, main page]
Skip to content

Commit 881fa02

Browse files
nicolas-grekasnicolas-grekas
committed
bug #36176 [Security] Check if firewall is stateless before checking for session/previous session (koenreiniers)
This PR was submitted for the 4.4 branch but it was squashed and merged into the 3.4 branch instead. Discussion ---------- [Security] Check if firewall is stateless before checking for session/previous session | Q | A | ------------- | --- | Branch? | 4.4 <!-- see below --> | Bug fix? | yes | New feature? | no <!-- please update src/**/CHANGELOG.md files --> | Deprecations? | no <!-- please update UPGRADE-*.md and src/**/CHANGELOG.md files --> | Tickets | - <!-- prefix each issue number with "Fix #", if any --> | License | MIT | Doc PR | - For one of our applications we had the issue that the session was always initialized, even for routes behind stateless firewalls. Using the redis session adapter this sometimes lead to exceptions if the connection failed. This change prevents the session from being initialized in the guard authentication handler for stateless firewalls Commits ------- 9bb1230 [Security] Check if firewall is stateless before checking for session/previous session
2 parents 5b5b61f + 9bb1230 commit 881fa02

File tree

2 files changed

+20
-1
lines changed

2 files changed

+20
-1
lines changed

‎src/Symfony/Component/Security/Guard/GuardAuthenticatorHandler.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -134,7 +134,7 @@ public function setSessionAuthenticationStrategy(SessionAuthenticationStrategyIn
134134

135135
private function migrateSession(Request $request, TokenInterface $token, $providerKey)
136136
{
137-
if (!$this->sessionStrategy || !$request->hasSession() || !$request->hasPreviousSession() || \in_array($providerKey, $this->statelessProviderKeys, true)) {
137+
if (\in_array($providerKey, $this->statelessProviderKeys, true) || !$this->sessionStrategy || !$request->hasSession() || !$request->hasPreviousSession()) {
138138
return;
139139
}
140140

‎src/Symfony/Component/Security/Guard/Tests/GuardAuthenticatorHandlerTest.php

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -149,6 +149,25 @@ public function testSessionStrategyIsNotCalledWhenStateless()
149149
$handler->authenticateWithToken($this->token, $this->request, 'some_provider_key');
150150
}
151151

152+
/**
153+
* @requires function \Symfony\Component\HttpFoundation\Request::setSessionFactory
154+
*/
155+
public function testSessionIsNotInstantiatedOnStatelessFirewall()
156+
{
157+
$sessionFactory = $this->getMockBuilder(\stdClass::class)
158+
->setMethods(['__invoke'])
159+
->getMock(); 8000
160+
161+
$sessionFactory->expects($this->never())
162+
->method('__invoke');
163+
164+
$this->request->setSessionFactory($sessionFactory);
165+
166+
$handler = new GuardAuthenticatorHandler($this->tokenStorage, $this->dispatcher, ['stateless_provider_key']);
167+
$handler->setSessionAuthenticationStrategy($this->sessionStrategy);
168+
$handler->authenticateWithToken($this->token, $this->request, 'stateless_provider_key');
169+
}
170+
152171
protected function setUp()
153172
{
154173
$this->tokenStorage = $this->getMockBuilder('Symfony\Component\Security\Core\Authentication\Token\Storage\TokenStorageInterface')->getMock();

0 commit comments

Comments
 (0)
0