8000 bug #49103 [Security/Http] Fix compat of persistent remember-me with … · symfony/symfony@96cdc5c · GitHub
[go: up one dir, main page]
Skip to content

Commit 96cdc5c

Browse files
nicolas-grekasnicolas-grekas
committed
bug #49103 [Security/Http] Fix compat of persistent remember-me with legacy tokens (nicolas-grekas)
This PR was merged into the 5.4 branch. Discussion ---------- [Security/Http] Fix compat of persistent remember-me with legacy tokens | Q | A | ------------- | --- | Branch? | 5.4 | Bug fix? | yes | New feature? | no | Deprecations? | no | Tickets | Fix #49100 | License | MIT | Doc PR | - In #49078, we changed the format of remember-me tokens, effectively invalidating them all. While the invalidation is intentional for signature-based remember-me handlers, persistent remember-me handlers could accept both legacy and updated tokens. This PR fixes compat with legacy tokens for persistent remember-me handlers. Commits ------- 538d660 [Security/Http] Fix compat of persistent remember-me with legacy tokens
2 parents aa82db9 + 538d660 commit 96cdc5c

File tree

3 files changed

+18
-2
lines changed

3 files changed

+18
-2
lines changed

‎src/Symfony/Component/Security/Http/RememberMe/PersistentRememberMeHandler.php

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,6 @@ final class PersistentRememberMeHandler extends AbstractRememberMeHandler
3434
{
3535
private $tokenProvider;
3636
private $tokenVerifier;
37-
private $secret;
3837

3938
public function __construct(TokenProviderInterface $tokenProvider, string $secret, UserProviderInterface $userProvider, RequestStack $requestStack, array $options, LoggerInterface $logger = null, TokenVerifierInterface $tokenVerifier = null)
4039
{
@@ -45,7 +44,6 @@ public function __construct(TokenProviderInterface $tokenProvider, string $secre
4544
}
4645
$this->tokenProvider = $tokenProvider;
4746
$this->tokenVerifier = $tokenVerifier;
48-
$this->secret = $secret;
4947
}
5048

5149
/**

‎src/Symfony/Component/Security/Http/RememberMe/RememberMeDetails.php

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,9 @@ public function __construct(string $userFqcn, string $userIdentifier, int $expir
3636

3737
public static function fromRawCookie(string $rawCookie): self
3838
{
39+
if (!str_contains($rawCookie, self::COOKIE_DELIMITER)) {
40+
$rawCookie = base64_decode($rawCookie);
41+
}
3942
$cookieParts = explode(self::COOKIE_DELIMITER, $rawCookie, 4);
4043
if (4 !== \count($cookieParts)) {
4144
throw new AuthenticationException('The cookie contains invalid data.');

‎src/Symfony/Component/Security/Http/Tests/RememberMe/PersistentRememberMeHandlerTest.php

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -156,4 +156,19 @@ public function testConsumeRememberMeCookieExpired()
156156

157157
$this->handler->consumeRememberMeCookie(new RememberMeDetails(InMemoryUser::class, 'wouter', 360, 'series1:tokenvalue'));
158158
}
159+
160+
public function testBase64EncodedTokens()
161+
{
162+
$this->tokenProvider->expects($this->any())
163+
->method('loadTokenBySeries')
164+
->with('series1')
165+
->willReturn(new PersistentToken(InMemoryUser::class, 'wouter', 'series1', 'tokenvalue', new \DateTime('-10 min')))
166+
;
167+
168+
$this->tokenProvider->expects($this->once())->method('updateToken')->with('series1');
169+
170+
$rememberMeDetails = new RememberMeDetails(InMemoryUser::class, 'wouter', 360, 'series1:tokenvalue');
171+
$rememberMeDetails = RememberMeDetails::fromRawCookie(base64_encode($rememberMeDetails->toString()));
172+
$this->handler->consumeRememberMeCookie($rememberMeDetails);
173+
}
159174
}

0 commit comments

Comments
 (0)
0