[Security] Return null instead of empty username to fix deprecation notice #59586
Conversation
This comment was marked as outdated.
This comment was marked as outdated.
|
The release page shows |
|
This should be a bug fix, not a security fix. Security fixes corresponds to modifications that address CVEs or vulnerability that endangers apps security, like these reports. |
|
@alexandre-daubois Thanks for the clarification; I've changed the base branch to 6.4. |
|
Can you please add a test case to cover this? |
| @@ -45,6 +45,6 @@ protected function extractUsername(Request $request): ?string | |||
| throw new BadCredentialsException(sprintf('User key was not found: "%s".', $this->userKey)); | |||
| } | |||
|
|
|||
| return $request->server->get($this->userKey); | |||
| return $request->server->get($this->userKey) ?: null; | |||
There was a problem hiding this comment.
Looking at how the method is used I wonder if we shouldn’t throw a BadCredentialsException here then.
|
Apologies; I ran into some trouble rebasing the commit for a test case so I created a new branch/PR to be safe: #59640 |
RemoteUserAuthenticatormay return an empty string when extracting a username from the configured$_SERVERparameter (e.g.REMOTE_USER).An empty username triggers the
User Deprecated: Since symfony/security-http 7.2: Using an empty string as user identifier is deprecated and will throw an exception in Symfony 8.0.Return
nullinstead of empty username to skip authenticator when username is empty and fix Symfony 8 deprecation notice.