8000 [Security] [RFC] Update Events to retrieve the *real* Authenticator in local env (CheckPassportEvent for instance) · Issue #49010 · symfony/symfony · GitHub
[go: up one dir, main page]

Skip to content
[Security] [RFC] Update Events to retrieve the *real* Authenticator in local env (CheckPassportEvent for instance) #49010
Closed
@florentdestremau

Description

@florentdestremau

Description

In local development, doing this will not return the real authenticator used but the TraceableAuthenticator instead if you use the profiler:

#[AsEventListener(event: CheckPassportEvent::class)]
public function onCheckPassport(CheckPassportEvent $checkPassportEvent): void
{
    $authenticator = $checkPassportEvent->getAuthenticator(); // TraceableAuthenticator
}

To get the real authenticator, you need to retrieve the nested one:

#[AsEventListener(event: CheckPassportEvent::class)]
public function onCheckPassport(CheckPassportEvent $checkPassportEvent): void
{
    $authenticator = $checkPassportEvent->getAuthenticator(); //TraceableAuthenticator
    $realAuthenticator = $authenticator instanceof TraceableAuthenticator ?
        $authenticator->getAuthenticator() : // FormLoginAuthenticator
        $authenticator; 
}

I would like to include the ternary inside the event class, as well as in the other Events having this method:

  • CheckPassportEvent.php
  • InteractiveLoginEvent.php
  • LoginFailureEvent.php
  • LoginSuccessEvent.php

I'm pinging @wouterj for the idea, I can make a PR if it's something worth it 🙂

Example

If this is accepted you will be able to call ->getAuthenticator() in a more uniform way.

#[AsEventListener(event: CheckPassportEvent::class)]
public function onCheckPassport(CheckPassportEvent $checkPassportEvent): void
{
    $authenticator = $checkPassportEvent->getAuthenticator(); // FormLoginAuthenticator event in dev environment
}

This is a simple version of possible PR:
https://github.com/symfony/symfony/compare/6.3...florentdestremau:symfony:feature/event-authenticator?expand=1

Questions:

  • should this replace the existing getAuthenticator?
  • should I create instead a getRealAuthenticator method to allow the existing method to return the TraceableAuthenticator?

Metadata

Metadata

Assignees

No one assigned

    Labels

    RFCRFC = Request For Comments (proposals about features that you want to be discussed)Security

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions

      0