symfony · fabpot · Apr 8, 2019 · Apr 7, 2019
diff --git a/UPGRADE-4.3.md b/UPGRADE-4.3.md
@@ -115,7 +115,7 @@ Security
  * The `Firewall::handleRequest()` method is deprecated, use `Firewall::callListeners()` instead.
  * The `AbstractToken::serialize()`, `AbstractToken::unserialize()`,
    `AuthenticationException::serialize()` and `AuthenticationException::unserialize()`
-   methods are now final, use `getState()` and `setState()` instead.
+   methods are now final, use `__serialize()` and `__unserialize()` instead.
 
    Before:
    ```php
@@ -133,15 +133,15 @@ Security
 
    After:
    ```php
-   protected function getState(): array
+   public function __serialize(): array
    {
-       return [$this->myLocalVar, parent::getState()];
+       return [$this->myLocalVar, parent::__serialize()];
    }
 
-   protected function setState(array $data)
+   public function __unserialize(array $data): void
    {
        [$this->myLocalVar, $parentData] = $data;
-       parent::setState($parentData);
+       parent::__unserialize($parentData);
    }
    ```
 

diff --git a/UPGRADE-5.0.md b/UPGRADE-5.0.md
@@ -293,7 +293,7 @@ Security
  * The `Firewall::handleRequest()` method has been removed, use `Firewall::callListeners()` instead.
  * `\Serializable` interface has been removed from `AbstractToken` and `AuthenticationException`,
    thus `serialize()` and `unserialize()` aren't available.
-   Use `getState()` and `setState()` instead.
+   Use `__serialize()` and `__unserialize()` instead.
 
    Before:
    ```php
@@ -311,15 +311,15 @@ Security
 
    After:
    ```php
-   protected function getState(): array
+   public function __serialize(): array
    {
-       return [$this->myLocalVar, parent::getState()];
+       return [$this->myLocalVar, parent::__serialize()];
    }
 
-   protected function setState(array $data)
+   public function __unserialize(array $data): void
    {
        [$this->myLocalVar, $parentData] = $data;
-       parent::setState($parentData);
+       parent::__unserialize($parentData);
    }
    ```
 

diff --git a/src/Symfony/Component/Form/Tests/Fixtures/CustomArrayObject.php b/src/Symfony/Component/Form/Tests/Fixtures/CustomArrayObject.php
@@ -58,13 +58,23 @@ public function count()
         return \count($this->array);
     }
 
+    public function __serialize(): array
+    {
+        return $this->array;
+    }
+
     public function serialize()
     {
-        return serialize($this->array);
+        return serialize($this->__serialize());
+    }
+
+    public function __unserialize(array $data): void
+    {
+        $this->array = $data;
     }
 
     public function unserialize($serialized)
     {
-        $this->array = (array) unserialize((string) $serialized);
+        $this->__unserialize((array) unserialize((string) $serialized));
     }
 }
diff --git a/src/Symfony/Component/PropertyAccess/Tests/Fixtures/NonTraversableArrayObject.php b/src/Symfony/Component/PropertyAccess/Tests/Fixtures/NonTraversableArrayObject.php
@@ -53,13 +53,23 @@ public function count()
         return \count($this->array);
     }
 
+    public function __serialize(): array
+        {
+        return $this->array;
+    }
+
     public function serialize()
     {
-        return serialize($this->array);
+        return serialize($this->__serialize());
+    }
+
+    public function __unserialize(array $data): void
+    {
+        $this->array = $data;
     }
 
     public function unserialize($serialized)
     {
-        $this->array = (array) unserialize((string) $serialized);
+        $this->__unserialize((array) unserialize((string) $serialized));
     }
 }
diff --git a/src/Symfony/Component/PropertyAccess/Tests/Fixtures/TraversableArrayObject.php b/src/Symfony/Component/PropertyAccess/Tests/Fixtures/TraversableArrayObject.php
@@ -58,13 +58,23 @@ public function count()
         return \count($this->array);
     }
 
+    public function __serialize(): array
+    {
+        return $this->array;
+    }
+
     public function serialize()
     {
-        return serialize($this->array);
+        return serialize($this->__serialize());
+    }
+
+    public function __unserialize(array $data): void
+    {
+        $this->array = $data;
     }
 
     public function unserialize($serialized)
     {
-        $this->array = (array) unserialize((string) $serialized);
+        $this->__unserialize((array) unserialize((string) $serialized));
     }
 }
diff --git a/src/Symfony/Component/Routing/CompiledRoute.php b/src/Symfony/Component/Routing/CompiledRoute.php
@@ -49,12 +49,9 @@ public function __construct(string $staticPrefix, string $regex, array $tokens,
         $this->variables = $variables;
     }
 
-    /**
-     * @internal since Symfony 4.3, will be removed in Symfony 5 as the class won't implement Serializable anymore
-     */
-    public function serialize()
+    public function __serialize(): array
     {
-        return serialize([
+        return [
             'vars' => $this->variables,
             'path_prefix' => $this->staticPrefix,
             'path_regex' => $this->regex,
@@ -63,16 +60,19 @@ public function serialize()
             'host_regex' => $this->hostRegex,
             'host_tokens' => $this->hostTokens,
             'host_vars' => $this->hostVariables,
-        ]);
+        ];
     }
 
     /**
      * @internal since Symfony 4.3, will be removed in Symfony 5 as the class won't implement Serializable anymore
      */
-    public function unserialize($serialized)
+    public function serialize()
     {
-        $data = unserialize($serialized, ['allowed_classes' => false]);
+        return serialize($this->__serialize());
+    }
 
+    public function __unserialize(array $data): void
+    {
         $this->variables = $data['vars'];
         $this->staticPrefix = $data['path_prefix'];
         $this->regex = $data['path_regex'];
@@ -83,6 +83,14 @@ public function unserialize($serialized)
         $this->hostVariables = $data['host_vars'];
     }
 
+    /**
+     * @internal since Symfony 4.3, will be removed in Symfony 5 as the class won't implement Serializable anymore
+     */
+    public function unserialize($serialized)
+    {
+        $this->__unserialize(unserialize($serialized, ['allowed_classes' => false]));
+    }
+
     /**
      * Returns the static prefix.
      *

diff --git a/src/Symfony/Component/Routing/Route.php b/src/Symfony/Component/Routing/Route.php
@@ -62,12 +62,9 @@ public function __construct(string $path, array $defaults = [], array $requireme
         $this->setCondition($condition);
     }
 
-    /**
-     * @internal since Symfony 4.3, will be removed in Symfony 5 as the class won't implement Serializable anymore
-     */
-    public function serialize()
+    public function __serialize(): array
     {
-        return serialize([
+        return [
             'path' => $this->path,
             'host' => $this->host,
             'defaults' => $this->defaults,
@@ -77,15 +74,19 @@ public function serialize()
             'methods' => $this->methods,
             'condition' => $this->condition,
             'compiled' => $this->compiled,
-        ]);
+        ];
     }
 
     /**
      * @internal since Symfony 4.3, will be removed in Symfony 5 as the class won't implement Serializable anymore
      */
-    public function unserialize($serialized)
+    public function serialize()
+    {
+        return serialize($this->__serialize());
+    }
+
+    public function __unserialize(array $data): void
     {
-        $data = unserialize($serialized);
         $this->path = $data['path'];
         $this->host = $data['host'];
         $this->defaults = $data['defaults'];
@@ -102,6 +103,14 @@ public function unserialize($serialized)
         }
     }
 
+    /**
+     * @internal since Symfony 4.3, will be removed in Symfony 5 as the class won't implement Serializable anymore
+     */
+    public function unserialize($serialized)
+    {
+        $this->__unserialize(unserialize($serialized));
+    }
+
     /**
      * Returns the pattern for the path.
      *

diff --git a/src/Symfony/Component/Security/CHANGELOG.md b/src/Symfony/Component/Security/CHANGELOG.md
@@ -11,7 +11,7 @@ CHANGELOG
  * The `getRoles()` method of the `TokenInterface` is deprecated. Tokens must implement the `getRoleNames()`
    method instead and return roles as strings.
  * Made the `serialize()` and `unserialize()` methods of `AbstractToken` and
-  `AuthenticationException` final, use `getState()`/`setState()` instead
+  `AuthenticationException` final, use `__serialize()`/`__unserialize()` instead
  * `AuthenticationException` doesn't implement `Serializable` anymore
  * Deprecated the `ListenerInterface`, turn your listeners into callables instead
  * Deprecated `Firewall::handleRequest()`, use `Firewall::callListeners()` instead

diff --git a/src/Symfony/Component/Security/Core/Authentication/Token/AbstractToken.php b/src/Symfony/Component/Security/Core/Authentication/Token/AbstractToken.php
@@ -142,16 +142,36 @@ public function eraseCredentials()
         }
     }
 
+    /**
+     * Returns all the necessary state of the object for serialization purposes.
+     *
+     * There is no need to serialize any entry, they should be returned as-is.
+     * If you extend this method, keep in mind you MUST guarantee parent data is present in the state.
+     * Here is an example of how to extend this method:
+     * <code>
+     *     public function __serialize(): array
+     *     {
+     *         return [$this->childAttribute, parent::__serialize()];
+   
10BC0
  *     }
+     * </code>
+     *
+     * @see __unserialize()
+     */
+    public function __serialize(): array
+    {
+        return [$this->user, $this->authenticated, $this->roles, $this->attributes, $this->roleNames];
+    }
+
     /**
      * {@inheritdoc}
      *
-     * @final since Symfony 4.3, use getState() instead
+     * @final since Symfony 4.3, use __serialize() instead
      *
-     * @internal since Symfony 4.3, use getState() instead
+     * @internal since Symfony 4.3, use __serialize() instead
      */
     public function serialize()
     {
-        $serialized = $this->getState();
+        $serialized = $this->__serialize();
 
         if (null === $isCalledFromOverridingMethod = \func_num_args() ? \func_get_arg(0) : null) {
             $trace = debug_backtrace(DEBUG_BACKTRACE_PROVIDE_OBJECT, 2);
@@ -162,56 +182,36 @@ public function serialize()
     }
 
     /**
-     * {@inheritdoc}
-     *
-     * @final since Symfony 4.3, use setState() instead
-     *
-     * @internal since Symfony 4.3, use setState() instead
-     */
-    public function unserialize($serialized)
-    {
-        $this->setState(\is_array($serialized) ? $serialized : unserialize($serialized));
-    }
-
-    /**
-     * Returns all the necessary state of the object for serialization purposes.
+     * Restores the object state from an array given by __serialize().
      *
-     * There is no need to serialize any entry, they should be returned as-is.
-     * If you extend this method, keep in mind you MUST guarantee parent data is present in the state.
+     * There is no need to unserialize any entry in $data, they are already ready-to-use.
+     * If you extend this method, keep in mind you MUST pass the parent data to its respective class.
      * Here is an example of how to extend this method:
      * <code>
-     *     protected function getState(): array
+     *     public function __unserialize(array $data): void
      *     {
-     *         return [$this->childAttribute, parent::getState()];
+     *         [$this->childAttribute, $parentData] = $data;
+     *         parent::__unserialize($parentData);
      *     }
      * </code>
      *
-     * @see setState()
+     * @see __serialize()
      */
-    protected function getState(): array
+    public function __unserialize(array $data): void
     {
-        return [$this->user, $this->authenticated, $this->roles, $this->attributes, $this->roleNames];
+        [$this->user, $this->authenticated, $this->roles, $this->attributes, $this->roleNames] = $data;
     }
 
     /**
-     * Restores the object state from an array given by getState().
+     * {@inheritdoc}
      *
-     * There is no need to unserialize any entry in $data, they are already ready-to-use.
-     * If you extend this method, keep in mind you MUST pass the parent data to its respective class.
-     * Here is an example of how to extend this method:
-     * <code>
-     *     protected function setState(array $data)
-     *     {
-     *         [$this->childAttribute, $parentData] = $data;
-     *         parent::setState($parentData);
-     *     }
-     * </code>
+     * @final since Symfony 4.3, use __unserialize() instead
      *
-     * @see getState()
+     * @internal since Symfony 4.3, use __unserialize() instead
      */
-    protected function setState(array $data)
+    public function unserialize($serialized)
     {
-        [$this->user, $this->authenticated, $this->roles, $this->attributes, $this->roleNames] = $data;
+        $this->__unserialize(\is_array($serialized) ? $serialized : unserialize($serialized));
     }
 
     /**

diff --git a/src/Symfony/Component/Security/Core/Authentication/Token/AnonymousToken.php b/src/Symfony/Component/Security/Core/Authentication/Token/AnonymousToken.php
@@ -55,17 +55,17 @@ public function getSecret()
     /**
      * {@inheritdoc}
      */
-    protected function getState(): array
+    public function __serialize(): array
     {
-        return [$this->secret, parent::getState()];
+        return [$this->secret, parent::__serialize()];
     }
 
     /**
      * {@inheritdoc}
      */
-    protected function setState(array $data)
+    public function __unserialize(array $data): void
     {
         [$this->secret, $parentData] = $data;
-        parent::setState($parentData);
+        parent::__unserialize($parentData);
     }
 }