10000 [Security] Support removing tokens from a session. · symfony/symfony@dabff0e · GitHub
[go: up one dir, main page]
Skip to content

Commit dabff0e

Browse files
dpb587dpb587
committed
[Security] Support removing tokens from a session.
1 parent c0f5b8a commit dabff0e

File tree

2 files changed

+88
-9
lines changed

2 files changed

+88
-9
lines changed

‎src/Symfony/Component/Security/Http/Firewall/ContextListener.php

Lines changed: 7 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -93,19 +93,17 @@ public function onKernelResponse(FilterResponseEvent $event)
9393
return;
9494
}
9595

96-
if (null === $token = $this->context->getToken()) {
97-
return;
98-
}
99-
100-
if (null === $token || $token instanceof AnonymousToken) {
101-
return;
102-
}
103-
10496
if (null !== $this->logger) {
10597
$this->logger->debug('Write SecurityContext in the session');
10698
}
10799

108-
$event->getRequest()->getSession()->set('_security_'.$this->contextKey, serialize($token));
100+
$session = $event->getRequest()->getSession();
101+
102+
if ((null === $token = $this->context->getToken()) || ($token instanceof AnonymousToken)) {
103+
$session->remove('_security_'.$this->contextKey);
104+
} else {
105+
$session->set('_security_'.$this->contextKey, serialize($token));
106+
}
109107
}
110108

111109
/**

‎tests/Symfony/Tests/Component/Security/Http/Firewall/ContextListenerTest.php

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
<?php
2+
3+
namespace Symfony\Test\Component\Security\Http\Firewall;
4+
5+
use Symfony\Component\HttpFoundation\Request;
6+
use Symfony\Component\HttpFoundation\Response;
7+
use Symfony\Component\HttpFoundation\Session;
8+
use Symfony\Component\HttpFoundation\SessionStorage\ArraySessionStorage;
9+
use Symfony\Component\HttpKernel\Event\FilterResponseEvent;
10+
use Symfony\Component\HttpKernel\HttpKernelInterface;
11+
use Symfony\Component\Security\Core\Authentication\Token\UsernamePasswordToken;
12+
use Symfony\Component\Security\Core\SecurityContext;
13+
use Symfony\Component\Security\Http\Firewall\ContextListener;
14+
15+
class ContextListenerTest extends \PHPUnit_Framework_TestCase
16+
{
17+
public function testOnKernelResponseWillAddSession()
18+
{
19+
$session = $this->runSessionOnKernelResponse(
20+
new UsernamePasswordToken('test1', 'pass1', 'phpunit'),
21+
null
22+
);
23+
24+
$token = unserialize($session->get('_security_session'));
25+
$this->assertInstanceOf('Symfony\Component\Security\Core\Authentication\Token\UsernamePasswordToken', $token);
26+
$this->assertEquals('test1', $token->getUsername());
27+
}
28+
29+
public function testOnKernelResponseWillReplaceSession()
30+
{
31+
$session = $this->runSessionOnKernelResponse(
32+
new UsernamePasswordToken('test1', 'pass1', 'phpunit'),
33+
'C:10:"serialized"'
34+
);
35+
36+
$token = unserialize($session->get('_security_session'));
37+
$this->assertInstanceOf('Symfony\Component\Security\Core\Authentication\Token\UsernamePasswordToken', $token);
38+
$this->assertEquals('test1', $token->getUsername());
39+
}
40+
41+
public function testOnKernelResponseWillRemoveSession()
42+
{
43+
$session = $this->runSessionOnKernelResponse(
44+
null,
45+
'C:10:"serialized"'
46+
);
47+
48+
$this->assertFalse($session->has('_security_session'));
49+
}
50+
51+
protected function runSessionOnKernelResponse($newToken, $original = null)
52+
{
53+
$session = new Session(new ArraySessionStorage());
54+
55+
if ($original !== null) {
56+
$session->set('_security_session', $original);
57+
}
58+
59+
60+
$securityContext = new SecurityContext(
61+
$this->getMock('Symfony\Component\Security\Core\Authentication\AuthenticationManagerInterface'),
62+
$this->getMock('Symfony\Component\Security\Core\Authorization\AccessDecisionManagerInterface')
63+
);
64+
$securityContext->setToken($newToken);
65+
66+
$request = new Request();
67+
$request->setSession($session);
68+
69+
$event = new FilterResponseEvent(
70+
$this->getMock('Symfony\Component\HttpKernel\HttpKernelInterface'),
71+
$request,
72+
HttpKernelInterface::MASTER_REQUEST,
73+
new Response()
74+
);
75+
76+
$listener = new ContextListener($securityContext, array(), 'session');
77+
$listener->onKernelResponse($event);
78+
79+
return $session;
80+
}
81+
}

0 commit comments

Comments
 (0)
0