[Cookbook][Security] don't output message from AuthenticationException #4761
Conversation
|
ping @weaverryan @wouterj I think this is something we should merge as soon as possible to avoid giving insecure advices. |
|
Thanks @xabbuh. I'm actually not familiar with this - I knew this approach could leak info, but had the approach you suggested always worked, or is it new? Where did the idea come from? Forgive my lack of knowledge here :) |
|
@stof made the suggestion in #4723 (comment). These methods are present in Symfony 2.3 too: http://api.symfony.com/2.3/Symfony/Component/Security/Core/Exception/AuthenticationException.html |
|
@weaverryan this is a feature added in Symfony 2.2 |
|
@xabbuh indeed, I made a mistake when giving the method name (I haven't checked the code or the api doc when commenting) |
|
@stof No problem, was not hard to guess the right method name. ;) |
| // ADD THIS use STATEMENT above your class | ||
| use Symfony\Component\Security\Core\SecurityContextInterface; | ||
|
|
||
| public function loginAction(Request $request) | ||
| { | ||
| $session = $request->getSession(); | ||
| $error = null; |
There was a problem hiding this comment.
I think having this in the else is more clear
There was a problem hiding this comment.
Good suggestion, this might not be the way it would usually be done in the Symfony core, but it's actually more readable. Changed it.
Displaying the message of an `AuthenticationException` might expose sensitive data to the user.
b4d986b to
44277c7
Compare
|
Thanks guys! I can't believe I had missed this. I used it recently in Silex in a KnpU tutorial, without even realizing how it fits into Symfony. I'm very happy to have this improved! |
…cationException (xabbuh) This PR was merged into the 2.3 branch. Discussion ---------- [Cookbook][Security] don't output message from AuthenticationException | Q | A | ------------- | --- | Doc fix? | yes | New docs? | no | Applies to | all | Fixed tickets | Displaying the message of an `AuthenticationException` might expose sensitive data to the user. Commits ------- 44277c7 don't output message from AuthenticationException
Displaying the message of an
AuthenticationExceptionmight exposesensitive data to the user.