Symfony version(s) affected

6.3

Description

Tests are broken on that project since Symfony 6.0 and after more investigation I found that Symfony is starting the session in DefaultAuthenticationSuccessHandler::onAuthenticationSuccess() when determineTargetUrl() read the session to get the target URL, even if the firewall is marked as stateless.

This result in the error:

Session was used while the request was declared stateless.

How to reproduce

Setup a stateless firewall using DefaultAuthenticationSuccessHandler.

See failing test here: hwi/HWIOAuthBundle#1938

Possible Solution

No response

Additional Context

No response