symfony · tyrelcher · Dec 4, 2021 · Dec 4, 2021 · Dec 4, 2021 · Dec 4, 2021
diff --git a/UPGRADE-6.2.md b/UPGRADE-6.2.md
@@ -5,3 +5,9 @@ Validator
 ---------
 
  * Deprecate the "loose" e-mail validation mode, use "html5" instead
+
+Security
+--------
+
+ * Deprecate `RememberMeHandler` not implementing `getUserIdentifierForCookie()`; `AbstractRememberMeHandler` has a default implementation
+ * Deprecate `RememberMeHandler` not implementing `getRememberMeDetails()`; `AbstractRememberMeHandler` has a default implementation
diff --git a/UPGRADE-7.0.md b/UPGRADE-7.0.md
@@ -0,0 +1,8 @@
+UPGRADE FROM 6.4 to 7.0
+=======================
+
+Security
+--------
+
+ * Add `getRememberMeDetails()` to `RememberMeHandlerInterface`.
+ * Add `getUserIdentifierForCookie()` to `RememberMeHandlerInterface`.
@@ -5,6 +5,8 @@ CHANGELOG
 ---
 
  * Add the `Security` helper class
+ * Add the `getUserIdentifierForCookie()` method to the `Symfony\Bundle\SecurityBundle\RememberMe\DecoratedRememberMeHandler`
+   and `Symfony\Bundle\SecurityBundle\RememberMe\FirewallAwareRememberMeHandler` classes
 
 6.1
 ---

@@ -47,6 +47,14 @@ public function consumeRememberMeCookie(RememberMeDetails $rememberMeDetails): U
         return $this->handler->consumeRememberMeCookie($rememberMeDetails);
     }
 
+    /**
+     * {@inheritDoc}
+     */
+    public function getUserIdentifierForCookie(RememberMeDetails $rememberMeDetails): string
+    {
+        return $this->handler->getUserIdentifierForCookie($rememberMeDetails);
+    }
+
     /**
      * {@inheritDoc}
      */

@@ -51,4 +51,9 @@ public function clearRememberMeCookie(): void
     {
         $this->getForFirewall()->clearRememberMeCookie();
     }
+
+    public function getUserIdentifierForCookie(RememberMeDetails $rememberMeDetails): string
+    {
+        return $this->getForFirewall()->getUserIdentifierForCookie($rememberMeDetails);
+    }
 }
@@ -38,6 +38,7 @@
  *
  * @author Johannes M. Schmitt <schmittjoh@gmail.com>
  * @author Wouter de Jong <wouter@wouterj.nl>
+ * @author Patrick Elshof <tyrelcher@protonmail.com>
  *
  * @final
  */
@@ -86,9 +87,19 @@ public function authenticate(Request $request): Passport
             throw new \LogicException('No remember-me cookie is found.');
         }
 
-        $rememberMeCookie = RememberMeDetails::fromRawCookie($rawCookie);
+        if (!\is_callable([$this->rememberMeHandler, 'getRememberMeDetails'])) {
+            $rememberMeCookie = RememberMeDetails::fromRawCookie($rawCookie);
+        } else {
+            $rememberMeCookie = $this->rememberMeHandler->getRememberMeDetails($rawCookie);
+        }
+
+        if (!\is_callable([$this->rememberMeHandler, 'getUserIdentifierForCookie'])) {
+            $userIdentifier = $rememberMeCookie->getUserIdentifier();
+        } else {
+            $userIdentifier = $this->rememberMeHandler->getUserIdentifierForCookie($rememberMeCookie);
+        }
 
-        return new SelfValidatingPassport(new UserBadge($rememberMeCookie->getUserIdentifier(), function () use ($rememberMeCookie) {
+        return new SelfValidatingPassport(new UserBadge($userIdentifier, function () use ($rememberMeCookie) {
             return $this->rememberMeHandler->consumeRememberMeCookie($rememberMeCookie);
         }));
     }

@@ -1,6 +1,14 @@
 CHANGELOG
 =========
 
+6.2
+---
+
+ * Deprecate `RememberMeHandler` not implementing `getUserIdentifierForCookie()`; `AbstractRememberMeHandler` has a default implementation
+ * Deprecate `RememberMeHandler` not implementing `getRememberMeDetails()`; `AbstractRememberMeHandler` has a default implementation
+ * Add `getRememberMeDetails()` method to `Symfony\Component\Security\Http\RememberMe\AbstractRememberMeHandler`
+ * Add `getUserIdentifierForCookie()` method to `Symfony\Component\Security\Http\RememberMe\AbstractRememberMeHandler`
+
 6.0
 ---
 

@@ -20,13 +20,14 @@
 
 /**
  * @author Wouter de Jong <wouter@wouterj.nl>
+ * @author Patrick Elshof <tyrelcher@protonmail.com>
  */
 abstract class AbstractRememberMeHandler implements RememberMeHandlerInterface
 {
     private UserProviderInterface $userProvider;
-    protected $requestStack;
-    protected $options;
-    protected $logger;
+    protected RequestStack $requestStack;
+    protected array $options;
+    protected ?LoggerInterface $logger;
 
     public function __construct(UserProviderInterface $userProvider, RequestStack $requestStack, array $options = [], LoggerInterface $logger = null)
     {
@@ -89,6 +90,29 @@ public function clearRememberMeCookie(): void
         $this->createCookie(null);
     }
 
+    /**
+     * Retrieves the User Identifier for the RememberMe cookie.
+     *
+     * If the cookie is required to contain the User Identifier {@see UserInterface::getUserIdentifier()}
+     * then it can simply be retrieved from the provided cookie details; if not, then it could be retrieved
+     * from elsewhere based on some other information provided (e.g. in a database).
+     */
+    public function getUserIdentifierForCookie(RememberMeDetails $rememberMeDetails): string
+    {
+        return $rememberMeDetails->getUserIdentifier();
+    }
+
+    /**
+     * Retrieves the RememberMeDetails using the raw cookie.
+     *
+     * This method allows the authenticator to retrieve the cookie details without needing
+     * to care about the implementation details used by the RememberMeHandler.
+     */
+    public function getRememberMeDetails(string $rawCookie): RememberMeDetails
+    {
+        return RememberMeDetails::fromRawCookie($rawCookie);
+    }
+
     /**
      * Creates the remember-me cookie using the correct configuration.
      *

@@ -21,6 +21,10 @@
  * {@see AbstractRememberMeHandler} instead.
  *
  * @author Wouter de Jong <wouter@wouterj.nl>
+ * @author Patrick Elshof <tyrelcher@protonmail.com>
+ *
+ * @method string            getUserIdentifierForCookie(RememberMeDetails $rememberMeDetails) Retrieves the User Identifier for the RememberMe cookie.
+ * @method RememberMeDetails getRememberMeDetails(string $rawCookie)                          Retrieves the RememberMeDetails using the raw cookie.
  */
 interface RememberMeHandlerInterface
 {

@@ -31,7 +31,11 @@ class RememberMeAuthenticatorTest extends TestCase
 
     protected function setUp(): void
     {
-        $this->rememberMeHandler = $this->createMock(RememberMeHandlerInterface::class);
+        $this->rememberMeHandler = $this->getMockBuilder(RememberMeHandlerInterface::class)
+            ->onlyMethods(get_class_methods(RememberMeHandlerInterface::class))
+            ->addMethods(['getRememberMeDetails', 'getUserIdentifierForCookie'])
+            ->getMock();
+
         $this->tokenStorage = new TokenStorage();
         $this->authenticator = new RememberMeAuthenticator($this->rememberMeHandler, 's3cr3t', $this->tokenStorage, '_remember_me_cookie');
     }
@@ -67,6 +71,15 @@ public function testAuthenticate()
     {
         $rememberMeDetails = new RememberMeDetails(InMemoryUser::class, 'wouter', 1, 'secret');
         $request = Request::create('/', 'GET', [], ['_remember_me_cookie' => $rememberMeDetails->toString()]);
+
+        $this->rememberMeHandler->expects($this->once())->method('getRememberMeDetails')
+            ->with($rememberMeDetails->toString())
+            ->willReturn($rememberMeDetails);
+
+        $this->rememberMeHandler->expects($this->once())->method('getUserIdentifierForCookie')
+            ->with($rememberMeDetails)
+            ->willReturn('wouter');
+
         $passport = $this->authenticator->authenticate($request);
 
         $this->rememberMeHandler->expects($this->once())->method('consumeRememberMeCookie')->with($this->callback(function ($arg) use ($rememberMeDetails) {
@@ -86,7 +99,46 @@ public function testAuthenticateWithoutOldToken()
     {
         $this->expectException(AuthenticationException::class);
 
-        $request = Request::create('/', 'GET', [], ['_remember_me_cookie' => base64_encode('foo:bar')]);
+        $encodedData = base64_encode('foo:bar');
+        $request = Request::create('/', 'GET', [], ['_remember_me_cookie' => $encodedData]);
+
+        $this->rememberMeHandler->expects($this->once())->method('getRememberMeDetails')->with($encodedData)->willThrowException(new AuthenticationException());
         $this->authenticator->authenticate($request);
     }
+
+    /**
+     * @group legacy
+     */
+    public function testAuthenticateDeprecatedCodePath()
+    {
+        $mock = $this->getMockBuilder(RememberMeHandlerInterface::class)
+            ->getMock();
+
+        $rememberMeDetails = new RememberMeDetails(InMemoryUser::class, 'wouter', 1, 'secret');
+        $request = Request::create('/', 'GET', [], ['_remember_me_cookie' => $rememberMeDetails->toString()]);
+
+        $authenticator = new RememberMeAuthenticator($mock, 's3cr3t', $this->tokenStorage, '_remember_me_cookie');
+        $passport = $authenticator->authenticate($request);
+
+        $mock->expects($this->once())->method('consumeRememberMeCookie')->with($this->callback(function ($arg) use ($rememberMeDetails) {
+            return $rememberMeDetails == $arg;
+        }));
+        $passport->getUser(); // trigger the user loader
+    }
+
+    /**
+     * @group legacy
+     */
+    public function testAuthenticateWithoutOldTokenDeprecatedCodePath()
+    {
+        $mock = $this->getMockBuilder(RememberMeHandlerInterface::class)
+            ->getMock();
+
+        $this->expectException(AuthenticationException::class);
+
+        $request = Request::create('/', 'GET', [], ['_remember_me_cookie' => base64_encode('foo:bar')]);
+
+        $authenticator = new RememberMeAuthenticator($mock, 's3cr3t', $this->tokenStorage, '_remember_me_cookie');
+        $authenticator->authenticate($request);
+    }
 }
@@ -130,4 +130,16 @@ public function testConsumeRememberMeCookieExpired()
 
         $this->handler->consumeRememberMeCookie(new RememberMeDetails(InMemoryUser::class, 'wouter', 360, 'series1:tokenvalue'));
     }
+
+    public function testGetUserIdentifierForCookie()
+    {
+        $this->assertEquals('wouter', $this->handler->getUserIdentifierForCookie(new RememberMeDetails(InMemoryUser::class, 'wouter', 360, 'signature')));
+    }
+
+    public function testGetRememberMeDetails()
+    {
+        $details = new RememberMeDetails(InMemoryUser::class, 'wouter', 360, 'signature');
+
+        $this->assertEquals($details, $this->handler->getRememberMeDetails($details->toString()));
+    }
 }
@@ -122,4 +122,16 @@ public function testConsumeRememberMeCookieExpired()
 
         $this->handler->consumeRememberMeCookie(new RememberMeDetails(InMemoryUser::class, 'wouter', 360, 'signature'));
     }
+
+    public function testGetUserIdentifierForCookie()
+    {
+        $this->assertEquals('wouter', $this->handler->getUserIdentifierForCookie(new RememberMeDetails(InMemoryUser::class, 'wouter', 360, 'signature')));
+    }
+
+    public function testGetRememberMeDetails()
+    {
+        $details = new RememberMeDetails(InMemoryUser::class, 'wouter', 360, 'signature');
+
+        $this->assertEquals($details, $this->handler->getRememberMeDetails($details->toString()));
+    }
 }
-Original file line number
+Diff line change
@@ Expand Up / @@ -5,6 +5,8 @@ CHANGELOG @@
     ---
      * Add the `Security` helper class
+     * Add the `getUserIdentifierForCookie()` method to the `Symfony\Bundle\SecurityBundle\RememberMe\DecoratedRememberMeHandler`
+       and `Symfony\Bundle\SecurityBundle\RememberMe\FirewallAwareRememberMeHandler` classes
 .1
     ---
@@ Expand Down @@