8000 [Security] Deprecate onAuthenticationSuccess() by weaverryan · Pull Request #18135 · symfony/symfony · GitHub
[go: up one dir, main page]

Skip to content

[Security] Deprecate onAuthenticationSuccess() #18135

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
Closed
Show file tree
Hide file tree
Changes from 1 commit
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Next Next commit
[#18027] Deprecate onAuthenticationSuccess() - it's simple enough to …
…implement
  • Loading branch information
weaverryan committed Mar 29, 2016
commit b1e75f7a7fb7571dcd09df73421864286601c402
Original file line number Diff line number Diff line change
Expand Up @@ -41,9 +41,14 @@ abstract protected function getLoginUrl();
* login page directly), this returns the URL the user should be redirected
* to after logging in successfully (e.g. your homepage).
*
* @deprecated Implement onAuthenticationFailure() instead of needing this function.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should this be:

@deprecated Implement onAuthenticationSuccess() instead of needing this function.

*
* @return string
*/
abstract protected function getDefaultSuccessRedirectUrl();
protected function getDefaultSuccessRedirectUrl()
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

As this one was abstract, it was always implemented, so this code is never going to be executed, right?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It will get executed if the user doesn't implement onAuthenticationSuccess or getDefaultSuccessRedirectURL(). In that case, this would be called here: 87. Since onAuthenticationSuccess is still implemented for BC, new users might not initially implement either, since there no interface/abstract method forces them to. It catches that case.

Also, deprecations are hard :).

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not sure I understand. Currently, the getDefaultSuccessRedirectUrl() method is abstract which means that nobody can use the AbstractFormLoginAuthenticator class without implementing it. In the wild, there is no code without a concrete implementation of this method. So, making it concrete now won't change anything as your code will always be overridden by user code, right?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I agree with @fabpot. I guess we should remove the method here. Then we can check below if the method exists, trigger a deprecation in that case and optionally call it (not sure right now if that is needed for backwards compatibility).

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ok, I've removed it :). The problem is purely for new users of this class: they technically won't be required at a PHP-level to implement getDefaultSuccessRedirectUrl or onAuthenticationSuccess. I was just trying to avoid an ugly "method not found" call. I've actually still handled this, with an if statement check.

{
throw new \Exception(sprintf('You must implement onAuthenticationSuccess() or getDefaultSuccessRedirectURL() in %s.', get_class($this)));
}

/**
* Override to change what happens after a bad username/password is submitted.
Expand Down Expand Up @@ -72,6 +77,8 @@ public function onAuthenticationFailure(Request $request, AuthenticationExceptio
*/
public function onAuthenticationSuccess(Request $request, TokenInterface $token, $providerKey)
{
@trigger_error(sprintf('The AbstractFormLoginAuthenticator::onAuthenticationSuccess() implementation was deprecated in Symfony 3.1 and will be removed in Symfony 4.0. You should implement this method yourself in %s and remove getDefaultSuccessRedirectUrl().', get_class($this)), E_USER_DEPRECATED);

// if the user hit a secure page and start() was called, this was
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

hit => hits

// the URL they were on, and probably where you want to redirect to
$targetPath = $this->getTargetPath($request->getSession(), $providerKey);
Expand Down
Original file line number Diff line number Diff line change
@@ -0,0 +1,67 @@
<?php

/*
* This file is part of the Symfony package.
*
* (c) Fabien Potencier <fabien@symfony.com>
*
* For the full copyright and license information, please view the LICENSE
* file that was distributed with this source code.
*/

namespace Symfony\Component\Security\Guard\Tests\Authenticator;

use Symfony\Component\HttpFoundation\RedirectResponse;
use Symfony\Component\HttpFoundation\Request;
use Symfony\Component\Security\Core\User\UserInterface;
use Symfony\Component\Security\Core\User\UserProviderInterface;
use Symfony\Component\Security\Guard\Authenticator\AbstractFormLoginAuthenticator;
class AbstractFormLoginAuthenticatorTest extends \PHPUnit_Framework_TestCase
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

missing empty line

{
/**
* @group legacy
*/
public function testLegacyWithLoginUrl()
{
$request = new Request();
$request->setSession($this->getMock('Symfony\Component\HttpFoundation\Session\Session'));

$authenticator = new LegacyFormLoginAuthenticator();
/** @var RedirectResponse $actualResponse */
$actualResponse = $authenticator->onAuthenticationSuccess(
$request,
$this->getMock('Symfony\Component\Security\Core\Authentication\Token\TokenInterface'),
'provider_key'
);

$this->assertEquals(
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

you can make it a one liner as it's a short assertion.

'/default_url',
$actualResponse->getTargetUrl()
);
}
}

class LegacyFormLoginAuthenticator extends AbstractFormLoginAuthenticator
{
protected function getDefaultSuccessRedirectUrl()
{
return '/default_url';
}

protected function getLoginUrl()
{
}

public function getCredentials(Request $request)
{
}

public function getUser($credentials, UserProviderInterface $userProvider)
{
}

public function checkCredentials($credentials, UserInterface $user)
{
}
}

0