Skip to content

Commit 99372fe

Browse files
chalasrchalasr
committed
[Security] Deprecate UserInterface & TokenInterface's eraseCredentials() 
1 parent cd24b4b commit 99372fe

File tree

149 files changed

+381
-39
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

149 files changed

+381
-39
lines changed

‎UPGRADE-7.3.md

Lines changed: 33 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,9 +6,40 @@ backward compatibility breaks. Minor backward compatibility breaks are prefixed
66
`[BC BREAK]`, make sure your code is compatible with these entries before upgrading.
77
Read more about this in the [Symfony documentation](https://symfony.com/doc/7.3/setup/upgrade_minor.html).
88

9-
If you're upgrading from a version below 7.1, follow the [7.2 upgrade guide](UPGRADE-7.2.md) first.
9+
If you're upgrading from a version below 7.2, follow the [7.2 upgrade guide](UPGRADE-7.2.md) first.
10+
11+
Table of Contents
12+
-----------------
13+
14+
Bundles
15+
16+
* [SecurityBundle](#SecurityBundle)
17+
18+
Bridges
19+
20+
Components
21+
22+
* [Ldap](#Ldap)
23+
* [Security](#Security)
24+
* [Serializer](#Serializer)
25+
26+
Ldap
27+
----
28+
29+
* Deprecate `LdapUser::eraseCredentials()`, use `LdapUser::setPassword(null)` instead
30+
31+
Security
32+
--------
33+
34+
* Deprecate `UserInterface::eraseCredentials()` and `TokenInterface::eraseCredentials()`,
35+
use a dedicated DTO or erase credentials on your own e.g. upon `AuthenticationTokenCreatedEvent` instead
36+
37+
SecurityBundle
38+
--------------
39+
40+
* Deprecate the `erase_credentials` config option, erase credentials on your own e.g. upon `AuthenticationTokenCreatedEvent` instead
1041

1142
Serializer
1243
----------
1344

14-
* Deprecate the `CompiledClassMetadataFactory` and `CompiledClassMetadataCacheWarmer` classes
45+
* Deprecate the `CompiledClassMetadataFactory` and `CompiledClassMetadataCacheWarmer` classes

‎src/Symfony/Bundle/FrameworkBundle/Tests/Functional/app/CacheAttributeListener/config.yml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ services:
1010
public: true
1111

1212
security:
13+
erase_credentials: false
1314
providers:
1415
main:
1516
memory:

‎src/Symfony/Bundle/FrameworkBundle/Tests/Functional/app/Security/config.yml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ services:
88
- container.service_subscriber
99

1010
security:
11+
erase_credentials: false
1112
providers:
1213
main:
1314
memory:

‎src/Symfony/Bundle/SecurityBundle/CHANGELOG.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ CHANGELOG
55
---
66

77
* Add `Security::isGrantedForUser()` to test user authorization without relying on the session. For example, users not currently logged in, or while processing a message from a message queue
8+
* Deprecate the `erase_credentials` config option, erase credentials on your own e.g. upon `AuthenticationTokenCreatedEvent` instead
89

910
7.2
1011
---

‎src/Symfony/Bundle/SecurityBundle/DependencyInjection/Security/Factory/LdapFactoryTrait.php

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@
1616
use Symfony\Component\DependencyInjection\Definition;
1717
use Symfony\Component\DependencyInjection\Reference;
1818
use Symfony\Component\Ldap\Security\CheckLdapCredentialsListener;
19+
use Symfony\Component\Ldap\Security\EraseLdapUserCredentialsListener;
1920
use Symfony\Component\Ldap\Security\LdapAuthenticator;
2021

2122
/**
@@ -42,6 +43,12 @@ public function createAuthenticator(ContainerBuilder $container, string $firewal
4243
->addArgument(new Reference('security.ldap_locator'))
4344
;
4445

46+
if (class_exists(EraseLdapUserCredentialsListener::class && !$container->getParameter('security.authentication.manager.erase_credentials'))) {
47+
$container->setDefinition('security.listener.'.$key.'.'.$firewallName.'erase_ldap_credentials', new Definition(EraseLdapUserCredentialsListener::class))
48+
->addTag('kernel.event_subscriber', ['dispatcher' => 'security.event_dispatcher.'.$firewallName])
49+
;
50+
}
51+
4552
$ldapAuthenticatorId = 'security.authenticator.'.$key.'.'.$firewallName;
4653
$definition = $container->setDefinition($ldapAuthenticatorId, new Definition(LdapAuthenticator::class))
4754
->setArguments([

‎src/Symfony/Bundle/SecurityBundle/DependencyInjection/SecurityExtension.php

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -135,6 +135,9 @@ public function load(array $configs, ContainerBuilder $container): void
135135

136136
// set some global scalars
137137
$container->setParameter('security.access.denied_url', $config['access_denied_url']);
138+
if (true === $config['erase_credentials']) {
139+
trigger_deprecation('symfony/security-bundle', '7.3', 'Setting the "security.erase_credentials" config option to true is deprecated and won\'t have any effect in 8.0, set it to false instead and use your own erasing logic if needed.');
140+
}
138141
$container->setParameter('security.authentication.manager.erase_credentials', $config['erase_credentials']);
139142
$container->setParameter('security.authentication.session_strategy.strategy', $config['session_fixation_strategy']);
140143

‎src/Symfony/Bundle/SecurityBundle/Tests/Debug/TraceableFirewallListenerTest.php

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -103,7 +103,9 @@ public function testOnKernelRequestRecordsAuthenticatorsInfo()
103103
[new TraceableAuthenticator($notSupportingAuthenticator), new TraceableAuthenticator($supportingAuthenticator)],
104104
$tokenStorage,
105105
$dispatcher,
106-
'main'
106+
'main',
107+
null,
108+
false
107109
);
108110

109111
$listener = new TraceableAuthenticatorManagerListener(new AuthenticatorManagerListener($authenticatorManager));

‎src/Symfony/Bundle/SecurityBundle/Tests/DependencyInjection/Compiler/AddSessionDomainConstraintPassTest.php

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -139,6 +139,7 @@ private function createContainer($sessionStorageOptions)
139139

140140
$config = [
141141
'security' => [
142+
'erase_credentials' => false,
142143
'providers' => ['some_provider' => ['id' => 'foo']],
143144
'firewalls' => ['some_firewall' => ['security' => false]],
144145
],

‎src/Symfony/Bundle/SecurityBundle/Tests/DependencyInjection/Compiler/MakeFirewallsEventDispatcherTraceablePassTest.php

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,7 @@ protected function setUp(): void
3434

3535
$this->container->registerExtension(new SecurityExtension());
3636
$this->container->loadFromExtension('security', [
37+
'erase_credentials' => false,
3738
'firewalls' => ['main' => ['pattern' => '/', 'http_basic' => true]],
3839
]);
3940

‎src/Symfony/Bundle/SecurityBundle/Tests/DependencyInjection/Compiler/RegisterGlobalSecurityEventListenersPassTest.php

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -56,6 +56,7 @@ protected function setUp(): void
5656
public function testEventIsPropagated(string $configuredEvent, string $registeredEvent)
5757
{
5858
$this->container->loadFromExtension('security', [
59+
'erase_credentials' => false,
5960
'firewalls' => ['main' => ['pattern' => '/', 'http_basic' => true]],
6061
]);
6162

@@ -89,6 +90,7 @@ public static function providePropagatedEvents(): array
8990
public function testRegisterCustomListener()
9091
{
9192
$this->container->loadFromExtension('security', [
93+
'erase_credentials' => false,
9294
'firewalls' => ['main' => ['pattern' => '/', 'http_basic' => true]],
9395
]);
9496

@@ -109,6 +111,7 @@ public function testRegisterCustomListener()
109111
public function testRegisterCustomSubscriber()
110112
{
111113
$this->container->loadFromExtension('security', [
114+
'erase_credentials' => false,
112115
'firewalls' => ['main' => ['pattern' => '/', 'http_basic' => true]],
113116
]);
114117

@@ -128,6 +131,7 @@ public function testRegisterCustomSubscriber()
128131
public function testMultipleFirewalls()
129132
{
130133
$this->container->loadFromExtension('security', [
134+
'erase_credentials' => false,
131135
'firewalls' => ['main' => ['pattern' => '/', 'http_basic' => true], 'api' => ['pattern' => '/api', 'http_basic' => true]],
132136
]);
133137

@@ -157,6 +161,7 @@ public function testMultipleFirewalls()
157161
public function testListenerAlreadySpecific()
158162
{
159163
$this->container->loadFromExtension('security', [
164+
'erase_credentials' => false,
160165
'firewalls' => ['main' => ['pattern' => '/', 'http_basic' => true]],
161166
]);
162167

‎src/Symfony/Bundle/SecurityBundle/Tests/DependencyInjection/Fixtures/php/access_decision_manager_customized_config.php

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
<?php
22

33
$container->loadFromExtension('security', [
4+
'erase_credentials' => false,
45
'access_decision_manager' => [
56
'allow_if_all_abstain' => true,
67
'allow_if_equal_granted_denied' => false,

‎src/Symfony/Bundle/SecurityBundle/Tests/DependencyInjection/Fixtures/php/access_decision_manager_default_strategy.php

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
<?php
22

33
$container->loadFromExtension('security', [
4+
'erase_credentials' => false,
45
'providers' => [
56
'default' => [
67
'memory' => [

‎src/Symfony/Bundle/SecurityBundle/Tests/DependencyInjection/Fixtures/php/access_decision_manager_service.php

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
<?php
22

33
$container->loadFromExtension('security', [
4+
'erase_credentials' => false,
45
'access_decision_manager' => [
56
'service' => 'app.access_decision_manager',
67
],

‎src/Symfony/Bundle/SecurityBundle/Tests/DependencyInjection/Fixtures/php/access_decision_manager_service_and_strategy.php

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
<?php
22

33
$container->loadFromExtension('security', [
4+
'erase_credentials' => false,
45
'access_decision_manager' => [
56
'service' => 'app.access_decision_manager',
67
'strategy' => 'affirmative',

‎src/Symfony/Bundle/SecurityBundle/Tests/DependencyInjection/Fixtures/php/access_decision_manager_strategy_service.php

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
<?php
22

33
$container->loadFromExtension('security', [
4+
'erase_credentials' => false,
45
'access_decision_manager' => [
56
'strategy_service' => 'app.custom_access_decision_strategy',
67
],

‎src/Symfony/Bundle/SecurityBundle/Tests/DependencyInjection/Fixtures/php/argon2i_hasher.php

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
$this->load('container1.php');
44

55
$container->loadFromExtension('security', [
6+
'erase_credentials' => false,
67
'password_hashers' => [
78
'JMS\FooBundle\Entity\User7' => [
89
'algorithm' => 'argon2i',

‎src/Symfony/Bundle/SecurityBundle/Tests/DependencyInjection/Fixtures/php/authenticator_manager.php

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
use Symfony\Component\Security\Http\Authenticator\Passport\Badge\CsrfTokenBadge;
44

55
$container->loadFromExtension('security', [
6+
'erase_credentials' => false,
67
'firewalls' => [
78
'main' => [
89
'required_badges' => [CsrfTokenBadge::class, 'RememberMeBadge'],

‎src/Symfony/Bundle/SecurityBundle/Tests/DependencyInjection/Fixtures/php/bcrypt_hasher.php

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
$this->load('container1.php');
44

55
$container->loadFromExtension('security', [
6+
'erase_credentials' => false,
67
'password_hashers' => [
78
'JMS\FooBundle\Entity\User7' => [
89
'algorithm' => 'bcrypt',

‎src/Symfony/Bundle/SecurityBundle/Tests/DependencyInjection/Fixtures/php/container1.php

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
<?php
22

33
$container->loadFromExtension('security', [
4+
'erase_credentials' => false,
45
'password_hashers' => [
56
'JMS\FooBundle\Entity\User1' => 'plaintext',
67
'JMS\FooBundle\Entity\User2' => [

‎src/Symfony/Bundle/SecurityBundle/Tests/DependencyInjection/Fixtures/php/firewall_patterns.php

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
<?php
22

33
$container->loadFromExtension('security', [
4+
'erase_credentials' => false,
45
'firewalls' => [
56
'no_security' => [
67
'pattern' => [

‎src/Symfony/Bundle/SecurityBundle/Tests/DependencyInjection/Fixtures/php/firewall_provider.php

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
<?php
22

33
$container->loadFromExtension('security', [
4+
'erase_credentials' => false,
45
'providers' => [
56
'default' => [
67
'memory' => $memory = [

‎src/Symfony/Bundle/SecurityBundle/Tests/DependencyInjection/Fixtures/php/firewall_undefined_provider.php

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
<?php
22

33
$container->loadFromExtension('security', [
4+
'erase_credentials' => false,
45
'providers' => [
56
'default' => [
67
'memory' => [

‎src/Symfony/Bundle/SecurityBundle/Tests/DependencyInjection/Fixtures/php/listener_provider.php

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
<?php
22

33
$container->loadFromExtension('security', [
4+
'erase_credentials' => false,
45
'providers' => [
56
'default' => [
67
'memory' => [

‎src/Symfony/Bundle/SecurityBundle/Tests/DependencyInjection/Fixtures/php/listener_undefined_provider.php

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
<?php
22

33
$container->loadFromExtension('security', [
4+
'erase_credentials' => false,
45
'providers' => [
56
'default' => [
67
'memory' => [

‎src/Symfony/Bundle/SecurityBundle/Tests/DependencyInjection/Fixtures/php/logout_clear_site_data.php

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
<?php
22

33
$container->loadFromExtension('security', [
4+
'erase_credentials' => false,
45
'providers' => [
56
'default' => ['id' => 'foo'],
67
],

‎src/Symfony/Bundle/SecurityBundle/Tests/DependencyInjection/Fixtures/php/merge.php

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
$this->load('merge_import.php');
44

55
$container->loadFromExtension('security', [
6+
'erase_credentials' => false,
67
'providers' => [
78
'default' => ['id' => 'foo'],
89
],

‎src/Symfony/Bundle/SecurityBundle/Tests/DependencyInjection/Fixtures/php/merge_import.php

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
<?php
22

33
$container->loadFromExtension('security', [
4+
'erase_credentials' => false,
45
'firewalls' => [
56
'main' => [
67
'form_login' => [

‎src/Symfony/Bundle/SecurityBundle/Tests/DependencyInjection/Fixtures/php/migrating_hasher.php

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
$this->load('container1.php');
44

55
$container->loadFromExtension('security', [
6+
'erase_credentials' => false,
67
'password_hashers' => [
78
'JMS\FooBundle\Entity\User7' => [
89
'algorithm' => 'argon2i',

‎src/Symfony/Bundle/SecurityBundle/Tests/DependencyInjection/Fixtures/php/no_custom_user_checker.php

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
<?php
22

33
$container->loadFromExtension('security', [
4+
'erase_credentials' => false,
45
'providers' => [
56
'default' => [
67
'memory' => [

‎src/Symfony/Bundle/SecurityBundle/Tests/DependencyInjection/Fixtures/php/remember_me_options.php

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
<?php
22

33
$container->loadFromExtension('security', [
4+
'erase_credentials' => false,
45
'providers' => [
56
'default' => ['id' => 'foo'],
67
],

‎src/Symfony/Bundle/SecurityBundle/Tests/DependencyInjection/Fixtures/php/sodium_hasher.php

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
$this->load('container1.php');
44

55
$container->loadFromExtension('security', [
6+
'erase_credentials' => false,
67
'password_hashers' => [
78
'JMS\FooBundle\Entity\User7' => [
89
'algorithm' => 'sodium',

‎src/Symfony/Bundle/SecurityBundle/Tests/DependencyInjection/Fixtures/xml/access_decision_manager_customized_config.xml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@
77
http://symfony.com/schema/dic/security
88
https://symfony.com/schema/dic/security/security-1.0.xsd">
99

10-
<config>
10+
<config erase-credentials="false">
1111
<access-decision-manager allow-if-all-abstain="true" allow-if-equal-granted-denied="false" />
1212

1313
<provider name="default">

‎src/Symfony/Bundle/SecurityBundle/Tests/DependencyInjection/Fixtures/xml/access_decision_manager_default_strategy.xml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@
77
http://symfony.com/schema/dic/security
88
https://symfony.com/schema/dic/security/security-1.0.xsd">
99

10-
<config>
10+
<config erase-credentials="false">
1111
<provider name="default">
1212
<memory>
1313
<user identifier="foo" password="foo" roles="ROLE_USER" />

‎src/Symfony/Bundle/SecurityBundle/Tests/DependencyInjection/Fixtures/xml/access_decision_manager_service.xml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@
77
http://symfony.com/schema/dic/security
88
https://symfony.com/schema/dic/security/security-1.0.xsd">
99

10-
<config>
10+
<config erase-credentials="false">
1111
<access-decision-manager service="app.access_decision_manager" />
1212

1313
<provider name="default">

‎src/Symfony/Bundle/SecurityBundle/Tests/DependencyInjection/Fixtures/xml/access_decision_manager_service_and_strategy.xml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@
77
http://symfony.com/schema/dic/security
88
https://symfony.com/schema/dic/security/security-1.0.xsd">
99

10-
<config>
10+
<config erase-credentials="false">
1111
<access-decision-manager service="app.access_decision_manager" strategy="affirmative" />
1212

1313
<provider name="default">

‎src/Symfony/Bundle/SecurityBundle/Tests/DependencyInjection/Fixtures/xml/access_decision_manager_strategy_service.xml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@
77
http://symfony.com/schema/dic/security
88
https://symfony.com/schema/dic/security/security-1.0.xsd">
99

10-
<config>
10+
<config erase-credentials="false">
1111
<access-decision-manager strategy-service="app.custom_access_decision_strategy" />
1212

1313
<provider name="default">

‎src/Symfony/Bundle/SecurityBundle/Tests/DependencyInjection/Fixtures/xml/argon2i_hasher.xml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212
<import resource="container1.xml"/>
1313
</imports>
1414

15-
<sec:config>
15+
<sec:config erase-credentials="false">
1616
<sec:password_hasher class="JMS\FooBundle\Entity\User7" algorithm="argon2i" memory-cost="256" time-cost="1" />
1717
</sec:config>
1818

‎src/Symfony/Bundle/SecurityBundle/Tests/DependencyInjection/Fixtures/xml/authenticator_manager.xml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@
77
http://symfony.com/schema/dic/security
88
https://symfony.com/schema/dic/security/security-1.0.xsd">
99

10-
<config>
10+
<config erase-credentials="false">
1111
<firewall name="main">
1212
<required-badge>Symfony\Component\Security\Http\Authenticator\Passport\Badge\CsrfTokenBadge</required-badge>
1313
<required-badge>RememberMeBadge</required-badge>

0 commit comments

Comments
 (0)