symfony
diff --git a/‎src/Symfony/Bundle/SecurityBundle/DependencyInjection/Security/Factory/LoginThrottlingFactory.php
+1 b/‎src/Symfony/Bundle/SecurityBundle/DependencyInjection/Security/Factory/LoginThrottlingFactory.php
+1
diff --git a/‎src/Symfony/Component/Security/Http/RateLimiter/DefaultLoginRateLimiter.php
+10-3 b/‎src/Symfony/Component/Security/Http/RateLimiter/DefaultLoginRateLimiter.php
+10-3
diff --git a/‎src/Symfony/Component/Security/Http/Tests/EventListener/LoginThrottlingListenerTest.php
+1-1 b/‎src/Symfony/Component/Security/Http/Tests/EventListener/LoginThrottlingListenerTest.php
+1-1
@@ -76,6 +76,7 @@ public function createAuthenticator(ContainerBuilder $container, string $firewal
             $container->register($config['limiter'] = 'security.login_throttling.'.$firewallName.'.limiter', DefaultLoginRateLimiter::class)
                 ->addArgument(new Reference('limiter.'.$globalId))
                 ->addArgument(new Reference('limiter.'.$localId))
+                ->addArgument('%kernel.secret%')
             ;
         }
 
 
@@ -28,21 +28,28 @@ final class DefaultLoginRateLimiter extends AbstractRequestRateLimiter
 {
     private RateLimiterFactory $globalFactory;
     private RateLimiterFactory $localFactory;
+    private ?string $secret;
 
-    public function __construct(RateLimiterFactory $globalFactory, RateLimiterFactory $localFactory)
+    public function __construct(RateLimiterFactory $globalFactory, RateLimiterFactory $localFactory, #[\SensitiveParameter] string $secret = null)
     {
+        if (!$secret) {
+            trigger_deprecation('symfony/security-http', '6.4', 'Calling "%s()" with an empty secret is deprecated, pass a non-empty string instead.', __METHOD__);
+        }
         $this->globalFactory = $globalFactory;
         $this->localFactory = $localFactory;
+        $this->secret = $secret;
     }
 
     protected function getLimiters(Request $request): array
     {
         $username = $request->attributes->get(SecurityRequestAttributes::LAST_USERNAME, '');
         $username = preg_match('//u', $username) ? mb_strtolower($username, 'UTF-8') : strtolower($username);
+        $ip = $this->secret ? hash_hmac('sha256', $request->getClientIp(), $this->secret) : $request->getClientIp();
+        $usernameAndIp = $this->secret ? hash_hmac('sha256', $username.'-'.$request->getClientIp(), $this->secret) : $username.'-'.$request->getClientIp();
 
         return [
-            $this->globalFactory->create($request->getClientIp()),
-            $this->localFactory->create($username.'-'.$request->getClientIp()),
+            $this->globalFactory->create($ip),
+            $this->localFactory->create($usernameAndIp),
         ];
     }
 }
@@ -47,7 +47,7 @@ protected function setUp(): void
             'limit' => 6,
             'interval' => '1 minute',
         ], new InMemoryStorage());
-        $limiter = new DefaultLoginRateLimiter($globalLimiter, $localLimiter);
+        $limiter = new DefaultLoginRateLimiter($globalLimiter, $localLimiter, '$3cre7');
 
         $this->listener = new LoginThrottlingListener($this->requestStack, $limiter);
     }
Original file line number	Diff line number	Diff line change
`@@ -76,6 +76,7 @@ public function createAuthenticator(ContainerBuilder $container, string $firewal`
`76`	`76`	`$container->register($config['limiter'] = 'security.login_throttling.'.$firewallName.'.limiter', DefaultLoginRateLimiter::class)`
`77`	`77`	`->addArgument(new Reference('limiter.'.$globalId))`
`78`	`78`	`->addArgument(new Reference('limiter.'.$localId))`
	`79`	`+ ->addArgument('%kernel.secret%')`
`79`	`80`	`;`
`80`	`81`	`}`
`81`	`82`
Original file line number	Diff line number	Diff line change
`@@ -28,21 +28,28 @@ final class DefaultLoginRateLimiter extends AbstractRequestRateLimiter`
`28`	`28`	`{`
`29`	`29`	`private RateLimiterFactory $globalFactory;`
`30`	`30`	`private RateLimiterFactory $localFactory;`
	`31`	`+ private ?string $secret;`
`31`	`32`
`32`		`- public function __construct(RateLimiterFactory $globalFactory, RateLimiterFactory $localFactory)`
	`33`	`+ public function __construct(RateLimiterFactory $globalFactory, RateLimiterFactory $localFactory, #[\SensitiveParameter] string $secret = null)`
`33`	`34`	`{`
	`35`	`+ if (!$secret) {`
	`36`	`+ trigger_deprecation('symfony/security-http', '6.4', 'Calling "%s()" with an empty secret is deprecated, pass a non-empty string instead.', __METHOD__);`
	`37`	`+ }`
`34`	`38`	`$this->globalFactory = $globalFactory;`
`35`	`39`	`$this->localFactory = $localFactory;`
	`40`	`+ $this->secret = $secret;`
`36`	`41`	`}`
`37`	`42`
`38`	`43`	`protected function getLimiters(Request $request): array`
`39`	`44`	`{`
`40`	`45`	`$username = $request->attributes->get(SecurityRequestAttributes::LAST_USERNAME, '');`
`41`	`46`	`$username = preg_match('//u', $username) ? mb_strtolower($username, 'UTF-8') : strtolower($username);`
	`47`	`+ $ip = $this->secret ? hash_hmac('sha256', $request->getClientIp(), $this->secret) : $request->getClientIp();`
	`48`	`+ $usernameAndIp = $this->secret ? hash_hmac('sha256', $username.'-'.$request->getClientIp(), $this->secret) : $username.'-'.$request->getClientIp();`
`42`	`49`
`43`	`50`	`return [`
`44`		`- $this->globalFactory->create($request->getClientIp()),`
`45`		`- $this->localFactory->create($username.'-'.$request->getClientIp()),`
	`51`	`+ $this->globalFactory->create($ip),`
	`52`	`+ $this->localFactory->create($usernameAndIp),`
`46`	`53`	`];`
`47`	`54`	`}`
`48`	`55`	`}`
Original file line number	Diff line number	Diff line change
`@@ -47,7 +47,7 @@ protected function setUp(): void`
`47`	`47`	`'limit' => 6,`
`48`	`48`	`'interval' => '1 minute',`
`49`	`49`	`], new InMemoryStorage());`
`50`		`- $limiter = new DefaultLoginRateLimiter($globalLimiter, $localLimiter);`
	`50`	`+ $limiter = new DefaultLoginRateLimiter($globalLimiter, $localLimiter, '$3cre7');`
`51`	`51`
`52`	`52`	`$this->listener = new LoginThrottlingListener($this->requestStack, $limiter);`
`53`	`53`	`}`