…ion on no token" (wouterj)

This PR was merged into the 5.4 branch.

Discussion
----------

[Security] Deprecate "always authenticate" and "exception on no token"

| Q             | A
| ------------- | ---
| Branch?       | 5.4
| Bug fix?      | no
| New feature?  | no
| Deprecations? | yes
| Tickets       | Ref #41613
| License       | MIT
| Doc PR        | n/a

Commits
-------

4bba287 [Security] Deprecate "always authenticate" and "exception on no token"

…)` (chalasr)

This PR was merged into the 5.4 branch.

Discussion
----------

[Security] Deprecate `TokenInterface::isAuthenticated()`

| Q             | A
| ------------- | ---
| Branch?       | 5.4
| Bug fix?      | no
| New feature?  | yes
| Deprecations? | no
| Tickets       | -
| License       | MIT
| Doc PR        | todo

From #41613 (comment)

> all unauthenticated token use-cases have been replaced with passports (and the removal of anonymous). This means that if you have a token, it should always be authenticated.

Commits
-------

33b8fbd [Security] Deprecate `TokenInterface::isAuthenticated()` and `setAuthenticated()`

…)` (chalasr)

This PR was merged into the 5.4 branch.

Discussion
----------

[Security] Deprecate `TokenInterface::isAuthenticated()`

| Q             | A
| ------------- | ---
| Branch?       | 5.4
| Bug fix?      | no
| New feature?  | yes
| Deprecations? | no
| Tickets       | -
| License       | MIT
| Doc PR        | todo

From symfony/symfony#41613 (comment)

> all unauthenticated token use-cases have been replaced with passports (and the removal of anonymous). This means that if you have a token, it should always be authenticated.

Commits
-------

33b8fbdd8a [Security] Deprecate `TokenInterface::isAuthenticated()` and `setAuthenticated()`

…)` (chalasr)

This PR was merged into the 5.4 branch.

Discussion
----------

[Security] Deprecate `TokenInterface::isAuthenticated()`

| Q             | A
| ------------- | ---
| Branch?       | 5.4
| Bug fix?      | no
| New feature?  | yes
| Deprecations? | no
| Tickets       | -
| License       | MIT
| Doc PR        | todo

From symfony/symfony#41613 (comment)

> all unauthenticated token use-cases have been replaced with passports (and the removal of anonymous). This means that if you have a token, it should always be authenticated.

Commits
-------

33b8fbdd8a [Security] Deprecate `TokenInterface::isAuthenticated()` and `setAuthenticated()`

…)` (chalasr)

This PR was merged into the 5.4 branch.

Discussion
----------

[Security] Deprecate `TokenInterface::isAuthenticated()`

| Q             | A
| ------------- | ---
| Branch?       | 5.4
| Bug fix?      | no
| New feature?  | yes
| Deprecations? | no
| Tickets       | -
| License       | MIT
| Doc PR        | todo

From symfony/symfony#41613 (comment)

> all unauthenticated token use-cases have been replaced with passports (and the removal of anonymous). This means that if you have a token, it should always be authenticated.

Commits
-------

33b8fbdd8a [Security] Deprecate `TokenInterface::isAuthenticated()` and `setAuthenticated()`

…)` (chalasr)

This PR was merged into the 5.4 branch.

Discussion
----------

[Security] Deprecate `TokenInterface::isAuthenticated()`

| Q             | A
| ------------- | ---
| Branch?       | 5.4
| Bug fix?      | no
| New feature?  | yes
| Deprecations? | no
| Tickets       | -
| License       | MIT
| Doc PR        | todo

From symfony/symfony#41613 (comment)

> all unauthenticated token use-cases have been replaced with passports (and the removal of anonymous). This means that if you have a token, it should always be authenticated.

Commits
-------

33b8fbdd8a [Security] Deprecate `TokenInterface::isAuthenticated()` and `setAuthenticated()`

…rity factories (wouterj)

This PR was merged into the 5.4 branch.

Discussion
----------

[SecurityBundle] Create a smooth upgrade path for security factories

| Q             | A
| ------------- | ---
| Branch?       | 5.4
| Bug fix?      | no
| New feature?  | yes
| Deprecations? | yes
| Tickets       | Ref #41613 (comment)
| License       | MIT
| Doc PR        | -

This change allows removing `SecurityFactoryInterface` in Symfony 6.

I've also changed the discrete ordering using "listener positions" to the much more common continuous ordering using priorities. I feel like priorities are much more self-explanatory.

Commits
-------

7385fd5 [SecurityBundle] Create a smooth upgrade path for security factories

This PR was merged into the 5.4 branch.

Discussion
----------

[Security] Deprecate legacy signatures

| Q             | A
| ------------- | ---
| Branch?       | 5.4
| Bug fix?      | no
| New feature?  | no
| Deprecations? | yes
| Tickets       | Ref #41613
| License       | MIT
| Doc PR        | n/a

Deprecates the left-over legacy constructor signatures in the Security system.

Commits
-------

bbc00c8 [Security] Deprecate legacy signatures

…BLIC_ACCESS attribute (wouterj)

This PR was squashed before being merged into the 5.3 branch.

Discussion
----------

[Security] Fix wrong cache directive when using the new PUBLIC_ACCESS attribute

| Q             | A
| ------------- | ---
| Branch?       | 5.3
| Bug fix?      | yes
| New feature?  | no
| Deprecations? | no
| Tickets       | Ref #41613 (comment)
| License       | MIT
| Doc PR        | -

`PUBLIC_ACCESS` is the new `IS_AUTHENTICATED_ANONYMOUSLY` since 5.2, but we didn't correctly check for this causing a private cache directive for a stateless page.

This PR also includes 2 changes from #42595 that could be backported to 5.3

Commits
-------

ca80ee3 [Security] Fix wrong cache directive when using the new PUBLIC_ACCESS attribute

…erj)

This PR was squashed before being merged into the 5.4 branch.

Discussion
----------

Fix incompatibilities with upcoming security 6.0

| Q             | A
| ------------- | ---
| Branch?       | 5.4
| Bug fix?      | yes
| New feature?  | no
| Deprecations? | yes
| Tickets       | -
| License       | MIT
| Doc PR        | -

Hats of to the person that invented the flipped tests on a new major branch! All these incompatibility bugs were discovered by the flipped tests of #41613

Commits
-------

96532e5 [SecurityHttp] Fix incompatibility with 6.0
fb45f6b [SecurityGuard] Fix incompatibility with 6.0
d2a1abf [SecurityBundle] Fix incompatibility with 6.0
4628689 [FrameworkBundle] Fix incompatibility with 6.0
98328ad [SecurityHttp] Fix incompatibility with 6.0
9137242 [PasswordHasher] Fix incompatibility with 6.0
915f75b [MonologBridge] Fix incompatibility with 6.0
0b59bc2 [Security] Minor fixes

This PR was merged into the 6.0 branch.

Discussion
----------

[SecurityBundle] Remove forgotten unused code

| Q             | A
| ------------- | ---
| Branch?       | 6.0
| Bug fix?      | no
| New feature?  | no
| Deprecations? | no
| Tickets       | -
| License       | MIT
| Doc PR        | -

Forgotten in #41613

Commits
-------

9d35f00 [SecurityBundle] Remove forgotten unused code

…ute from the XSD (MatTheCat)

This PR was merged into the 6.4 branch.

Discussion
----------

[SecurityBundle] Remove unused memory users’ `name` attribute from the XSD

| Q             | A
| ------------- | ---
| Branch?       | 6.4
| Bug fix?      | yes
| New feature?  | no
| Deprecations? | no
| Issues        | N/A
| License       | MIT

The related config has been deprecated in #40403 and removed in #41613.

Commits
-------

656f498 [SecurityBundle] Remove unused memory users’ `name` attribute from the XSD

…ibute from the XSD (MatTheCat)

This PR was merged into the 6.4 branch.

Discussion
----------

[SecurityBundle] Remove unused memory users’ `name` attribute from the XSD

| Q             | A
| ------------- | ---
| Branch?       | 6.4
| Bug fix?      | yes
| New feature?  | no
| Deprecations? | no
| Issues        | Fix cdb8354
| License       | MIT

#57520 has been reverted because

> [The] change […] risks that someone receives errors on the next patch release if their XML config still makes use of the now removed attribute.

But nobody could use it since v6.0: as #41613 removed the BC layer, the config would crash.

Keeping `name` in the XSD for 6.4, 7.0 and 7.1 branches means people using these versions would have their IDE suggesting an attribute which would make their app crash.

Commits
-------

ed5c26c [SecurityBundle] Remove unused memory users’ `name` attribute from the XSD