From 692cf7b1b164a4aeba118dc6b57a8829c6b3180c Mon Sep 17 00:00:00 2001
From: Michel Hunziker <info@michelhunziker.com>
Date: Sun, 28 Jul 2024 11:27:42 +0200
Subject: [PATCH] [Security] Do not remove existing session on stateless
 requests

---
 .../Http/Firewall/ContextListener.php         |  2 +-
 .../Tests/Firewall/ContextListenerTest.php    | 23 +++++++++++++++++++
 2 files changed, 24 insertions(+), 1 deletion(-)

diff --git a/src/Symfony/Component/Security/Http/Firewall/ContextListener.php b/src/Symfony/Component/Security/Http/Firewall/ContextListener.php
index a48ca7e38482e..3e45ee37af08e 100644
--- a/src/Symfony/Component/Security/Http/Firewall/ContextListener.php
+++ b/src/Symfony/Component/Security/Http/Firewall/ContextListener.php
@@ -175,7 +175,7 @@ public function onKernelResponse(ResponseEvent $event)
 
         $request = $event->getRequest();
 
-        if (!$request->hasSession() || $request->attributes->get('_security_firewall_run') !== $this->sessionKey) {
+        if (!$request->hasSession() || $request->attributes->getBoolean('_stateless') || $request->attributes->get('_security_firewall_run') !== $this->sessionKey) {
             return;
         }
 
diff --git a/src/Symfony/Component/Security/Http/Tests/Firewall/ContextListenerTest.php b/src/Symfony/Component/Security/Http/Tests/Firewall/ContextListenerTest.php
index 5389e54ac690f..78ab5acddaf65 100644
--- a/src/Symfony/Component/Security/Http/Tests/Firewall/ContextListenerTest.php
+++ b/src/Symfony/Component/Security/Http/Tests/Firewall/ContextListenerTest.php
@@ -146,6 +146,29 @@ public function testOnKernelResponseWithoutSessionNorToken()
         $this->assertFalse($session->isStarted());
     }
 
+    public function testOnKernelResponseWithStatelessAndPreviousSession()
+    {
+        $request = new Request();
+        $request->attributes->set('_security_firewall_run', '_security_session');
+        $request->attributes->set('_stateless', true);
+
+        $session = new Session(new MockArraySessionStorage());
+        $request->setSession($session);
+        $request->cookies->set('MOCKSESSID', true);
+
+        $event = new ResponseEvent(
+            $this->createMock(HttpKernelInterface::class),
+            $request,
+            HttpKernelInterface::MAIN_REQUEST,
+            new Response()
+        );
+
+        $listener = new ContextListener(new TokenStorage(), [], 'session', null, new EventDispatcher());
+        $listener->onKernelResponse($event);
+
+        $this->assertFalse($session->isStarted());
+    }
+
     /**
      * @dataProvider provideInvalidToken
      */