reject remember-me token if user check fails

kbond · kbond · commit fe190b6ee964 · 2017-10-12T11:00:29.000-04:00
diff --git a/src/Symfony/Component/Security/Core/Authentication/Provider/RememberMeAuthenticationProvider.php b/src/Symfony/Component/Security/Core/Authentication/Provider/RememberMeAuthenticationProvider.php
@@ -49,6 +49,7 @@ public function authenticate(TokenInterface $token)
 
         $user = $token->getUser();
         $this->userChecker->checkPreAuth($user);
+        $this->userChecker->checkPostAuth($user);
 
         $authenticatedToken = new RememberMeToken($user, $this->providerKey, $this->key);
         $authenticatedToken->setAttributes($token->getAttributes());
