UserLoader Not Called #50511

cesurapp · 2023-05-31T15:16:01Z

Symfony version(s) affected

6.3

Description

Always using the default userLoader.

AccessTokenHandler:

readonly class AccessTokenHandler implements AccessTokenHandlerInterface
{
    public function __construct(private UserRepository $userRepo, private JWT $jwt)
    {
    }

    public function getUserBadgeFrom(#[\SensitiveParameter] string $accessToken): UserBadge
    {
        $userId = $this->decodeJWT($accessToken)['id'];
        $user = $this->userRepo->find($userId);

        return new UserBadge($userId, fn () => $user);
    }
    ....
}

How to reproduce

class UserRepository extends ApiServiceEntityRepository implements PasswordUpgraderInterface, UserLoaderInterface
{
    public function loadUserByIdentifier(string|int $identifier): ?User
    {
        $q = $this->createQueryBuilder('q');

        if (is_numeric($identifier)) {
            $q->where('q.phone = :identity')->setParameter('identity', (int) $identifier);
        } else {
            $q->where('q.email = :identity')->setParameter('identity', $identifier);
        }

        return $q->getQuery()->getOneOrNullResult();
    }
    ....
}

Possible Solution

Before:
if (null === $userBadge->getUserLoader() && $this->userProvider) {

New Code:
https://github.com/vincentchalamon/symfony/blob/99a35f0fc32a7b5250aab5530129bae318c95209/src/Symfony/Component/Security/Http/Authenticator/AccessTokenAuthenticator.php#LL62C35-L62C35

Feature:
#48272

Additional Context

No response

The text was updated successfully, but these errors were encountered:

chalasr · 2023-05-31T15:22:58Z

Would you mind sending a PR?

fixes symfony#50511

This PR was merged into the 6.3 branch. Discussion ---------- [Security] Fix loading user from UserBadge | Q | A | ------------- | --- | Branch? | 6.3 | Bug fix? | yes | New feature? | no | Deprecations? | no | Tickets | Fix #50511 | License | MIT | Doc PR | none Fixed a breaking change from https://github.com/symfony/symfony/pull/48272/files#diff-de9707bb338188f62878f2ebd42e7a7bf9547f6d0bf07a4fcd9c386c263c601b Commits ------- 21532cb Fix breaking change in AccessTokenAuthenticator

cesurapp added the Bug label May 31, 2023

carsonbot added the Status: Needs Review label May 31, 2023

cesurapp mentioned this issue May 31, 2023

[Security] Bugfix UserBadge userLoader #50513

Closed

xabbuh added the Security label Jun 5, 2023

This was referenced Jul 25, 2023

[BC][Security] Badge-specific user loader overridden by default user provider #51103

Closed

[Security] Fix loading user from UserBadge #51104

Merged

guillaumesmo added a commit to guillaumesmo/symfony that referenced this issue Jul 25, 2023

Fix breaking change in AccessTokenAuthenticator

6f6bc12

fixes symfony#50511

guillaumesmo added a commit to guillaumesmo/symfony that referenced this issue Jul 25, 2023

Fix breaking change in AccessTokenAuthenticator

99a217f

fixes symfony#50511

guillaumesmo added a commit to guillaumesmo/symfony that referenced this issue Jul 26, 2023

Fix breaking change in AccessTokenAuthenticator

ea93785

fixes symfony#50511

guillaumesmo added a commit to guillaumesmo/symfony that referenced this issue Jul 28, 2023

Fix breaking change in AccessTokenAuthenticator

21532cb

fixes symfony#50511

fabpot closed this as completed Aug 25, 2023

guillaumesmo mentioned this issue Aug 25, 2023

[Security] UserBadge->userLoader always overwritten by AccessTokenAuthenticator->userProvider when later is set regardless of former #51446

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

UserLoader Not Called #50511

UserLoader Not Called #50511

Uh oh!