symfony · derrabus · Aug 1, 2021 · Jul 30, 2021
@@ -11,6 +11,7 @@ CHANGELOG
    use `security.password_hasher_factory` and `Symfony\Component\PasswordHasher\Hasher\PasswordHasherFactoryInterface` instead
  * Remove the `security.user_password_encoder.generic` service, the `security.password_encoder` and the `Symfony\Component\Security\Core\Encoder\UserPasswordEncoderInterface` aliases,
    use `security.user_password_hasher`, `security.password_hasher` and `Symfony\Component\PasswordHasher\Hasher\UserPasswordHasherInterface` instead
+ * Remove the `logout.success_handler` and `logout.handlers` config options, register a listener on the `LogoutEvent` event instead
 
 5.4
 ---

@@ -18,7 +18,6 @@
 use Symfony\Component\Config\Definition\Exception\InvalidConfigurationException;
 use Symfony\Component\Security\Core\Authorization\AccessDecisionManager;
 use Symfony\Component\Security\Http\EntryPoint\AuthenticationEntryPointInterface;
-use Symfony\Component\Security\Http\Event\LogoutEvent;
 use Symfony\Component\Security\Http\Session\SessionAuthenticationStrategy;
 
 /**
@@ -216,7 +215,6 @@ private function addFirewallsSection(ArrayNodeDefinition $rootNode, array $facto
                     ->scalarNode('csrf_token_id')->defaultValue('logout')->end()
                     ->scalarNode('path')->defaultValue('/logout')->end()
                     ->scalarNode('target')->defaultValue('/')->end()
-                    ->scalarNode('success_handler')->setDeprecated('symfony/security-bundle', '5.1', sprintf('The "%%node%%" at path "%%path%%" is deprecated, register a listener on the "%s" event instead.', LogoutEvent::class))->end()
                     ->booleanNode('invalidate_session')->defaultTrue()->end()
                 ->end()
                 ->fixXmlConfig('delete_cookie')
@@ -238,12 +236,6 @@ private function addFirewallsSection(ArrayNodeDefinition $rootNode, array $facto
                         ->end()
                     ->end()
                 ->end()
-                ->fixXmlConfig('handler')
-                ->children()
-                    ->arrayNode('handlers')
-                        ->prototype('scalar')->setDeprecated('symfony/security-bundle', '5.1', sprintf('The "%%node%%" at path "%%path%%" is deprecated, register a listener on the "%s" event instead.', LogoutEvent::class))->end()
-                    ->end()
-                ->end()
             ->end()
             ->arrayNode('switch_user')
                 ->canBeUnset()

@@ -17,7 +17,6 @@
 use Symfony\Bundle\SecurityBundle\DependencyInjection\Security\Factory\RememberMeFactory;
 use Symfony\Bundle\SecurityBundle\DependencyInjection\Security\Factory\SecurityFactoryInterface;
 use Symfony\Bundle\SecurityBundle\DependencyInjection\Security\UserProvider\UserProviderFactoryInterface;
-use Symfony\Bundle\SecurityBundle\Security\LegacyLogoutHandlerListener;
 use Symfony\Component\Config\Definition\Exception\InvalidConfigurationException;
 use Symfony\Component\Config\FileLocator;
 use Symfony\Component\Console\Application;
@@ -422,19 +421,10 @@ private function createFirewall(ContainerBuilder $container, string $id, array $
                 'logout_path' => $firewall['logout']['path'],
             ]);
 
-            // add default logout listener
-            if (isset($firewall['logout']['success_handler'])) {
-                // deprecated, to be removed in Symfony 6.0
-                $logoutSuccessHandlerId = $firewall['logout']['success_handler'];
-                $container->register('security.logout.listener.legacy_success_listener.'.$id, LegacyLogoutHandlerListener::class)
-                    ->setArguments([new Reference($logoutSuccessHandlerId)])
-                    ->addTag('kernel.event_subscriber', ['dispatcher' => $firewallEventDispatcherId]);
-            } else {
-                $logoutSuccessListenerId = 'security.logout.listener.default.'.$id;
-                $container->setDefinition($logoutSuccessListenerId, new ChildDefinition('security.logout.listener.default'))
-                    ->replaceArgument(1, $firewall['logout']['target'])
-                    ->addTag('kernel.event_subscriber', ['dispatcher' => $firewallEventDispatcherId]);
-            }
+            $logoutSuccessListenerId = 'security.logout.listener.default.'.$id;
+            $container->setDefinition($logoutSuccessListenerId, new ChildDefinition('security.logout.listener.default'))
+                ->replaceArgument(1, $firewall['logout']['target'])
+                ->addTag('kernel.event_subscriber', ['dispatcher' => $firewallEventDispatcherId]);
 
             // add CSRF provider
             if (isset($firewall['logout']['csrf_token_generator'])) {
@@ -454,13 +444,6 @@ private function createFirewall(ContainerBuilder $container, string $id, array $
                     ->addTag('kernel.event_subscriber', ['dispatcher' => $firewallEventDispatcherId]);
             }
 
-            // add custom listeners (deprecated)
-            foreach ($firewall['logout']['handlers'] as $i => $handlerId) {
-                $container->register('security.logout.listener.legacy_handler.'.$i, LegacyLogoutHandlerListener::class)
-                    ->addArgument(new Reference($handlerId))
-                    ->addTag('kernel.event_subscriber', ['dispatcher' => $firewallEventDispatcherId]);
-            }
-
             // register with LogoutUrlGenerator
             $container
                 ->getDefinition('security.logout_url_generator')

@@ -195,7 +195,6 @@
         <xsd:attribute name="csrf-token-id" type="xsd:string" />
         <xsd:attribute name="path" type="xsd:string" />
         <xsd:attribute name="target" type="xsd:string" />
-        <xsd:attribute name="success-handler" type="xsd:string" />
         <xsd:attribute name="invalidate-session" type="xsd:boolean" />
     </xsd:complexType>
 

@@ -45,34 +45,6 @@ public function testCsrfTokensAreClearedOnLogout()
         });
     }
 
-    /**
-     * @group legacy
-     */
-    public function testLegacyCsrfTokensAreClearedOnLogout()
-    {
-        $client = $this->createClient(['enable_authenticator_manager' => false, 'test_case' => 'LogoutWithoutSessionInvalidation', 'root_config' => 'config.yml']);
-        $client->disableReboot();
-        $this->callInRequestContext($client, function () {
-            static::getContainer()->get('security.csrf.token_storage')->setToken('foo', 'bar');
-        });
-
-        $client->request('POST', '/login', [
-            '_username' => 'johannes',
-            '_password' => 'test',
-        ]);
-
-        $this->callInRequestContext($client, function () {
-            $this->assertTrue(static::getContainer()->get('security.csrf.token_storage')->hasToken('foo'));
-            $this->assertSame('bar', static::getContainer()->get('security.csrf.token_storage')->getToken('foo'));
-        });
-
-        $client->request('GET', '/logout');
-
-        $this->callInRequestContext($client, function () {
-            $this->assertFalse(static::getContainer()->get('security.csrf.token_storage')->hasToken('foo'));
-        });
-    }
-
     public function testAccessControlDoesNotApplyOnLogout()
     {
         $client = $this->createClient(['enable_authenticator_manager' => true, 'test_case' => 'Logout', 'root_config' => 'config_access.yml']);

@@ -22,25 +22,6 @@ public function testSessionRememberMeSecureCookieFlagAuto($https, $expectedSecur
         $this->assertSame($expectedSecureFlag, $cookies['']['/']['REMEMBERME']->isSecure());
     }
 
-    /**
-     * @dataProvider getSessionRememberMeSecureCookieFlagAutoHttpsMap
-     * @group legacy
-     */
-    public function testLegacySessionRememberMeSecureCookieFlagAuto($https, $expectedSecureFlag)
-    {
-        $client = $this->createClient(['test_case' => 'RememberMeCookie', 'root_config' => 'legacy_config.yml']);
-
-        $client->request('POST', '/login', [
-            '_username' => 'test',
-            '_password' => 'test',
-        ], [], [
-            'HTTPS' => (int) $https,
-        ]);
-
-        $cookies = $client->getResponse()->headers->getCookies(ResponseHeaderBag::COOKIES_ARRAY);
-        $this->assertSame($expectedSecureFlag, $cookies['']['/']['REMEMBERME']->isSecure());
-    }
-
     public function getSessionRememberMeSecureCookieFlagAutoHttpsMap()
     {
         return [

@@ -1,6 +1,13 @@
 CHANGELOG
 =========
 
+6.0
+---
+
+ * Remove `LogoutSuccessHandlerInterface` and `LogoutHandlerInterface`, register a listener on the `LogoutEvent` event instead
+ * Remove `CookieClearingLogoutHandler`, `SessionLogoutHandler` and `CsrfTokenClearingLogoutHandler`.
+   Use `CookieClearingLogoutListener`, `SessionLogoutListener` and `CsrfTokenClearingLogoutListener` instead
+
 5.4
 ---
 

@@ -11,19 +11,15 @@
 
 namespace Symfony\Component\Security\Http\Firewall;
 
-use Symfony\Component\EventDispatcher\EventDispatcher;
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\Response;
 use Symfony\Component\HttpKernel\Event\RequestEvent;
 use Symfony\Component\Security\Core\Authentication\Token\Storage\TokenStorageInterface;
-use Symfony\Component\Security\Core\Exception\LogicException;
 use Symfony\Component\Security\Core\Exception\LogoutException;
 use Symfony\Component\Security\Csrf\CsrfToken;
 use Symfony\Component\Security\Csrf\CsrfTokenManagerInterface;
 use Symfony\Component\Security\Http\Event\LogoutEvent;
 use Symfony\Component\Security\Http\HttpUtils;
-use Symfony\Component\Security\Http\Logout\LogoutHandlerInterface;
-use Symfony\Component\Security\Http\Logout\LogoutSuccessHandlerInterface;
 use Symfony\Component\Security\Http\ParameterBagUtils;
 use Symfony\Contracts\EventDispatcher\EventDispatcherInterface;
 
@@ -43,25 +39,10 @@ class LogoutListener extends AbstractListener
     private $eventDispatcher;
 
     /**
-     * @param EventDispatcherInterface $eventDispatcher
-     * @param array                    $options         An array of options to process a logout attempt
+     * @param array $options An array of options to process a logout attempt
      */
-    public function __construct(TokenStorageInterface $tokenStorage, HttpUtils $httpUtils, $eventDispatcher, array $options = [], CsrfTokenManagerInterface $csrfTokenManager = null)
+    public function __construct(TokenStorageInterface $tokenStorage, HttpUtils $httpUtils, EventDispatcherInterface $eventDispatcher, array $options = [], CsrfTokenManagerInterface $csrfTokenManager = null)
     {
-        if (!$eventDispatcher instanceof EventDispatcherInterface) {
-            trigger_deprecation('symfony/security-http', '5.1', 'Passing a logout success handler to "%s" is deprecated, pass an instance of "%s" instead.', __METHOD__, EventDispatcherInterface::class);
-
-            if (!$eventDispatcher instanceof LogoutSuccessHandlerInterface) {
-                throw new \TypeError(sprintf('Argument 3 of "%s" must be instance of "%s" or "%s", "%s" given.', __METHOD__, EventDispatcherInterface::class, LogoutSuccessHandlerInterface::class, get_debug_type($eventDispatcher)));
-            }
-
-            $successHandler = $eventDispatcher;
-            $eventDispatcher = new EventDispatcher();
-            $eventDispatcher->addListener(LogoutEvent::class, function (LogoutEvent $event) use ($successHandler) {
-                $event->setResponse($r = $successHandler->onLogoutSuccess($event->getRequest()));
-            });
-        }
-
         $this->tokenStorage = $tokenStorage;
         $this->httpUtils = $httpUtils;
         $this->options = array_merge([
@@ -73,22 +54,6 @@ public function __construct(TokenStorageInterface $tokenStorage, HttpUtils $http
         $this->eventDispatcher = $eventDispatcher;
     }
 
-    /**
-     * @deprecated since Symfony 5.1
-     */
-    public function addHandler(LogoutHandlerInterface $handler)
-    {
-        trigger_deprecation('symfony/security-http', '5.1', 'Calling "%s" is deprecated, register a listener on the "%s" event instead.', __METHOD__, LogoutEvent::class);
-
-        $this->eventDispatcher->addListener(LogoutEvent::class, function (LogoutEvent $event) use ($handler) {
-            if (null === $event->getResponse()) {
-                throw new LogicException(sprintf('No response was set for this logout action. Make sure the DefaultLogoutListener or another listener has set the response before "%s" is called.', __CLASS__));
-            }
-
-            $handler->logout($event->getRequest(), $event->getResponse(), $event->getToken());
-        });
-    }
-
     /**
      * {@inheritdoc}
      */