8000 [Security] REMEMBERME cookie does not get deleted using the "logout_o… · symfony/symfony@aefe84c · GitHub
[go: up one dir, main page]
Skip to content

Commit aefe84c

Browse files
Amrouche HamzaSimperfit
Amrouche Hamza
authored and
Simperfit
committed
[Security] REMEMBERME cookie does not get deleted using the "logout_on_user_change" option
1 parent e376c99 commit aefe84c

File tree

3 files changed

+50
-1
lines changed

3 files changed

+50
-1
lines changed

‎src/Symfony/Bundle/SecurityBundle/Resources/config/security_listeners.xml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,7 @@
4545
<argument type="service" id="logger" on-invalid="null" />
4646
<argument type="service" id="event_dispatcher" on-invalid="null" />
4747
<argument type="service" id="security.authentication.trust_resolver" />
48+
<argument type="service" id="security.authentication.rememberme" on-invalid="null" />
4849
</service>
4950

5051
<service id="security.logout_listener" class="Symfony\Component\Security\Http\Firewall\LogoutListener" abstract="true">

‎src/Symfony/Component/Security/Http/Firewall/ContextListener.php

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,7 @@
2727
use Symfony\Component\Security\Core\Role\SwitchUserRole;
2828
use Symfony\Component\Security\Core\User\UserInterface;
2929
use Symfony\Component\Security\Core\User\UserProviderInterface;
30+
use Symfony\Component\Security\Http\RememberMe\RememberMeServicesInterface;
3031

3132
/**
3233
* ContextListener manages the SecurityContext persistence through a session.
@@ -44,12 +45,13 @@ class ContextListener implements ListenerInterface
4445
private $registered;
4546
private $trustResolver;
4647
private $logoutOnUserChange = false;
48+
private $rememberMeServices;
4749

4850
/**
4951
* @param iterable|UserProviderInterface[] $userProviders
5052
* @param string $contextKey
5153
*/
52-
public function __construct(TokenStorageInterface $tokenStorage, $userProviders, $contextKey, LoggerInterface $logger = null, EventDispatcherInterface $dispatcher = null, AuthenticationTrustResolverInterface $trustResolver = null)
54+
public function __construct(TokenStorageInterface $tokenStorage, $userProviders, $contextKey, LoggerInterface $logger = null, EventDispatcherInterface $dispatcher = null, AuthenticationTrustResolverInterface $trustResolver = null, RememberMeServicesInterface $rememberMeServices = null)
5355
{
5456
if (empty($contextKey)) {
5557
throw new \InvalidArgumentException('$contextKey must not be empty.');
@@ -61,6 +63,7 @@ public function __construct(TokenStorageInterface $tokenStorage, $userProviders,
6163
$this->logger = $logger;
6264
$this->dispatcher = $dispatcher;
6365
$this->trustResolver = $trustResolver ?: new AuthenticationTrustResolver(AnonymousToken::class, RememberMeToken::class);
66+
$this->rememberMeServices = $rememberMeServices;
6467
}
6568

6669
/**
@@ -103,6 +106,10 @@ public function handle(GetResponseEvent $event)
103106

104107
if ($token instanceof TokenInterface) {
105108
$token = $this->refreshUser($token);
109+
110+
if (null === $token && null !== $this->rememberMeServices) {
111+
$this->rememberMeServices->loginFail($request);
112+
}
106113
} elseif (null !== $token) {
107114
if (null !== $this->logger) {
108115
$this->logger->warning('Expected a security token from the session, got something else.', ['key' => $this->sessionKey, 'received' => $token]);

‎src/Symfony/Component/Security/Http/Tests/Firewall/ContextListenerTest.php

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@
1111

1212
namespace Symfony\Component\Security\Http\Tests\Firewall;
1313

14+
use PHPUnit\Framework\Assert;
1415
use PHPUnit\Framework\TestCase;
1516
use Symfony\Component\EventDispatcher\EventDispatcher;
1617
use Symfony\Component\HttpFoundation\Request;
@@ -24,13 +25,15 @@
2425
use Symfony\Component\Security\Core\Authentication\Token\AnonymousToken;
2526
use Symfony\Component\Security\Core\Authentication\Token\Storage\TokenStorage;
2627
use Symfony\Component\Security\Core\Authentication\Token\Storage\TokenStorageInterface;
28+
use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
2729
use Symfony\Component\Security\Core\Authentication\Token\UsernamePasswordToken;
2830
use Symfony\Component\Security\Core\Exception\UnsupportedUserException;
2931
use Symfony\Component\Security\Core\Exception\UsernameNotFoundException;
3032
use Symfony\Component\Security\Core\User\User;
3133
use Symfony\Component\Security\Core\User\UserInterface;
3234
use Symfony\Component\Security\Core\User\UserProviderInterface;
3335
use Symfony\Component\Security\Http\Firewall\ContextListener;
36+
use Symfony\Component\Security\Http\RememberMe\RememberMeServicesInterface;
3437

3538
class ContextListenerTest extends TestCase
3639
{
@@ -316,6 +319,26 @@ public function testRuntimeExceptionIsThrownIfNoSupportingUserProviderWasRegiste
316319
$this->handleEventWithPreviousSession(new TokenStorage(), [new NotSupportingUserProvider(), new NotSupportingUserProvider()]);
317320
}
318321

322+
public function testLogoutOnChangeEventAsBeenSent()
323+
{
324+
$tokenStorage = new TokenStorage();
325+
$refreshedUser = new User('foobar', 'baz');
326+
327+
$user = new User('foo', 'bar');
328+
329+
$session = new Session(new MockArraySessionStorage());
330+
$session->set('_security_context_key', serialize(new UsernamePasswordToken($user, '', 'context_key', ['ROLE_USER'])));
331+
332+
$request = new Request();
333+
$request->setSession($session);
334+
$request->cookies->set('MOCKSESSID', true);
335+
$listener = new ContextListener($tokenStorage, [new NotSupportingUserProvider(), new SupportingUserProvider($refreshedUser)], 'context_key', null, null, null, new testRememberMeServices($this));
336+
$listener->setLogoutOnUserChange($refreshedUser);
337+
$listener->handle(new GetResponseEvent($this->getMockBuilder('Symfony\Component\HttpKernel\HttpKernelInterface')->getMock(), $request, HttpKernelInterface::MASTER_REQUEST));
338+
339+
$this->assertNull($tokenStorage->getToken());
340+
}
341+
319342
public function testAcceptsProvidersAsTraversable()
320343
{
321344
$tokenStorage = new TokenStorage();
@@ -387,6 +410,24 @@ public function supportsClass($class)
387410
}
388411
}
389412

413+
class testRememberMeServices implements RememberMeServicesInterface
414+
{
415+
public function autoLogin(Request $request)
416+
{
417+
}
418+
419+
public function loginFail(Request $request, \Exception $exception = null)
420+
{
421+
Assert::assertTrue($request->cookies->get('MOCKSESSID'));
422+
423+
return null;
424+
}
425+
426+
public function loginSuccess(Request $request, Response $response, TokenInterface $token)
427+
{
428+
}
429+
}
430+
390431
class Suppor 41C2 tingUserProvider implements UserProviderInterface
391432
{
392433
private $refreshedUser;

0 commit comments

Comments
 (0)
0