10000 Container fails with stateless firewalls with the new authenticatior manager enabled · Issue #37119 · symfony/symfony · GitHub
[go: up one dir, main page]

Skip to content
Container fails with stateless firewalls with the new authenticatior manager enabled #37119
Closed
@johnvandeweghe

Description

@johnvandeweghe

Symfony version(s) affected: 5.1.0

Description
If a stateless firewall is defined, and the new authenticator manager is enabled the 66E5 following error occurs:

Argument 2 of service "security.listener.session" is abstract: stateless firewall keys.

Some digging appears that the need for the second argument was removed in a recent refactor of the Symfony\Component\Security\Http\EventListener\SessionStrategyListener and the \Symfony\Bundle\SecurityBundle\DependencyInjection\SecurityExtension was updated to no longer add the firewall keys, but in an unrelated refactor changed the service definition in Resources/config/security_authenticator.xml to the following:

        <service id="security.listener.session"
                 class="Symfony\Component\Security\Http\EventListener\SessionStrategyListener"
                 abstract="true">
            <argument type="service" id="security.authentication.session_strategy" />
            <argument type="abstract">stateless firewall keys</argument>
        </service>

This appears to be the root of the issue.

How to reproduce
Minimal example repo: https://github.com/johnvandeweghe/sf-session-listener-bug

  1. Add enable_authenticator_manager: true to security.yaml
  2. Add a stateless firewall:
main:
            pattern: ^/api
            stateless: true
            http_basic: ~
  1. Try to run the bin/console script.

Possible Solution
Changing the service definition to the following - removing the abstract definition and the second argument - fixes it for me (and matches up with the class code):

        <service id="security.listener.session"
                 class="Symfony\Component\Security\Http\EventListener\SessionStrategyListener">
            <argument type="service" id="security.authentication.session_strategy" />
        </service>

Additional context
This doesn't appear to be a problem if there are no stateless firewalls defined, which is likely why it has gone unnoticed during development.

This is my first bug report for Symfony, let me know if any more detail is needed!

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions

      0