Closed
Description
Symfony version(s) affected: 5.2.x
Description
UserInterface::getPassword() is allowed to return a null value. In case it does, PasswordMigratingListener::onLoginSuccess calling PasswordEncoderInterface::needsRehash fails because that does not allow null input:
Argument 1 passed to Symfony\Component\Security\Core\Encoder\MigratingPasswordEncoder::needsRehash() must be of the type string, null given, called in (...)/vendor/symfony/security-http/EventListener/PasswordMigratingListener.php on line 54
How to reproduce
Maybe trivial: create a standard authentication setup using a custom User class, which returns null in the getPassword() method. When logging in, the mentioned exception occurs.