8000 bug #41741 [Security] Fix invalid RememberMe value after update (jder… · symfony/symfony@fe366a0 · GitHub
[go: up one dir, main page]
Skip to content

Commit fe366a0

Browse files
wouterjwouterj
committed
bug #41741 [Security] Fix invalid RememberMe value after update (jderusse)
This PR was merged into the 5.3 branch. Discussion ---------- [Security] Fix invalid RememberMe value after update | Q | A | ------------- | --- | Branch? | 5.3 | Bug fix? | yes | New feature? | no | Deprecations? | no | Tickets | - | License | MIT | Doc PR | - When refreshing the rememberMe cookie value, the `series` part where lost, leading to an invalid RememberMe cookie the next time we want to use it. Commits ------- f3b11e7 [Security] Fix value lost in RememberMe update
2 parents 853c916 + f3b11e7 commit fe366a0

File tree

2 files changed

+9
-3
lines changed

2 files changed

+9
-3
lines changed

‎src/Symfony/Component/Security/Http/RememberMe/PersistentRememberMeHandler.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -98,7 +98,7 @@ public function processRememberMe(RememberMeDetails $rememberMeDetails, UserInte
9898
$this->tokenProvider->updateToken($series, $tokenValueHash, $tokenLastUsed);
9999
}
100100

101-
$this->createCookie($rememberMeDetails->withValue($tokenValue));
101+
$this->createCookie($rememberMeDetails->withValue($series.':'.$tokenValue));
102102
}
103103

104104
/**

‎src/Symfony/Component/Security/Http/Tests/RememberMe/PersistentRememberMeHandlerTest.php

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -92,8 +92,14 @@ public function testConsumeRememberMeCookieValid()
9292

9393
/** @var Cookie $cookie */
9494
$cookie = $this->request->attributes->get(ResponseListener::COOKIE_ATTR_NAME);
95-
$this->assertNotEquals($rememberMeDetails->toString(), $cookie->getValue());
96-
$this->assertMatchesRegularExpression('{'.str_replace('\\', '\\\\', base64_decode($rememberMeDetails->withValue('[a-zA-Z0-9/+]+')->toString())).'}', base64_decode($cookie->getValue()));
95+
$rememberParts = explode(':', base64_decode($rememberMeDetails->toString()), 4);
96+
$cookieParts = explode(':', base64_decode($cookie->getValue()), 4);
97+
98+
$this->assertSame($rememberParts[0], $cookieParts[0]); // class
99+
$this->assertSame($rememberParts[1], $cookieParts[1]); // identifier
100+
$this->assertSame($rememberParts[2], $cookieParts[2]); // expire
101+
$this->assertNotSame($rememberParts[3], $cookieParts[3]); // value
102+
$this->assertSame(explode(':', $rememberParts[3])[0], explode(':', $cookieParts[3])[0]); // series
97103
}
98104

99105
public function testConsumeRememberMeCookieInvalidToken()

0 commit comments

Comments
 (0)
0