Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Appearance settings

Commit 069cdb0

Browse filesBrowse files
nicolas-grekasnicolas-grekas
committed
[Security] always check the token on non-lazy firewalls
1 parent 2a91f28 commit 069cdb0
Copy full SHA for 069cdb0

File tree

7 files changed

+131
-2
lines changed
Filter options

7 files changed

+131
-2
lines changed

‎src/Symfony/Bundle/SecurityBundle/Tests/Functional/AnonymousTest.php

Copy file name to clipboard
+24Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
<?php
2+
3+
/*
4+
* This file is part of the Symfony package.
5+
*
6+
* (c) Fabien Potencier <fabien@symfony.com>
7+
*
8+
* For the full copyright and license information, please view the LICENSE
9+
* file that was distributed with this source code.
10+
*/
11+
12+
namespace Symfony\Bundle\SecurityBundle\Tests\Functional;
13+
14+
class AnonymousTest extends AbstractWebTestCase
15+
{
16+
public function testAnonymous()
17+
{
18+
$client = $this->createClient(['test_case' => 'Anonymous', 'root_config' => 'config.yml']);
19+
20+
$client->request('GET', '/');
21+
22+
$this->assertSame(401, $client->getResponse()->getStatusCode());
23+
}
24+
}

‎src/Symfony/Bundle/SecurityBundle/Tests/Functional/Bundle/AnonymousBundle/AppCustomAuthenticator.php

Copy file name to clipboard
+55Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
<?php
2+
3+
/*
4+
* This file is part of the Symfony package.
5+
*
6+
* (c) Fabien Potencier <fabien@symfony.com>
7+
*
8+
* For the full copyright and license information, please view the LICENSE
9+
* file that was distributed with this source code.
10+
*/
11+
12+
namespace Symfony\Bundle\SecurityBundle\Tests\Functional\Bundle\AnonymousBundle;
13+
14+
use Symfony\Component\HttpFoundation\Request;
15+
use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
16+
use Symfony\Component\Security\Core\Exception\AuthenticationException;
17+
use Symfony\Component\Security\Core\User\UserInterface;
18+
use Symfony\Component\Security\Core\User\UserProviderInterface;
19+
use Symfony\Component\Security\Guard\AbstractGuardAuthenticator;
20+
21+
class AppCustomAuthenticator extends AbstractGuardAuthenticator
22+
{
23+
public function supports(Request $request)
24+
{
25+
return false;
26+
}
27+
28+
public function getCredentials(Request $request)
29+
{
30+
}
31+
32+
public function getUser($credentials, UserProviderInterface $userProvider)
33+
{
34+
}
35+
36+
public function checkCredentials($credentials, UserInterface $user)
37+
{
38+
}
39+
40+
public function onAuthenticationFailure(Request $request, AuthenticationException $exception)
41+
{
42+
}
43+
44+
public function onAuthenticationSuccess(Request $request, TokenInterface $token, $providerKey)
45+
{
46+
}
47+
48+
public function start(Request $request, AuthenticationException $authException = null)
49+
{
50+
}
51+
52+
public function supportsRememberMe()
53+
{
54+
}
55+
}

‎src/Symfony/Bundle/SecurityBundle/Tests/Functional/app/Anonymous/bundles.php

Copy file name to clipboard
+15Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
<?php
2+
3+
/*
4+
* This file is part of the Symfony package.
5+
*
6+
* (c) Fabien Potencier <fabien@symfony.com>
7+
*
8+
* For the full copyright and license information, please view the LICENSE
9+
* file that was distributed with this source code.
10+
*/
11+
12+
return [
13+
new Symfony\Bundle\FrameworkBundle\FrameworkBundle(),
14+
new Symfony\Bundle\SecurityBundle\SecurityBundle(),
15+
];

‎src/Symfony/Bundle/SecurityBundle/Tests/Functional/app/Anonymous/config.yml

Copy file name to clipboard
+24Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
framework:
2+
secret: test
3+
router: { resource: "%kernel.project_dir%/%kernel.test_case%/routing.yml" }
4+
validation: { enabled: true, enable_annotations: true }
5+
csrf_protection: true
6+
form: true
7+
test: ~
8+
default_locale: en
9+
session:
10+
storage_id: session.storage.mock_file
11+
profiler: { only_exceptions: false }
12+
13+
services:
14+
Symfony\Bundle\SecurityBundle\Tests\Functional\Bundle\AnonymousBundle\AppCustomAuthenticator: ~
15+
16+
security:
17+
firewalls:
18+
secure:
19+
pattern: ^/
20+
anonymous: false
21+
stateless: true
22+
guard:
23+
authenticators:
24+
- Symfony\Bundle\SecurityBundle\Tests\Functional\Bundle\AnonymousBundle\AppCustomAuthenticator

‎src/Symfony/Bundle/SecurityBundle/Tests/Functional/app/Anonymous/routing.yml

Copy file name to clipboard
+5Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
main:
2+
path: /
3+
defaults:
4+
_controller: Symfony\Bundle\FrameworkBundle\Controller\RedirectController::urlRedirectAction
5+
path: /app

‎src/Symfony/Component/Security/Http/Firewall/AccessListener.php

Copy file name to clipboardExpand all lines: src/Symfony/Component/Security/Http/Firewall/AccessListener.php
+6-1Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@
1818
use Symfony\Component\Security\Core\Exception\AccessDeniedException;
1919
use Symfony\Component\Security\Core\Exception\AuthenticationCredentialsNotFoundException;
2020
use Symfony\Component\Security\Http\AccessMapInterface;
21+
use Symfony\Component\Security\Http\Event\LazyResponseEvent;
2122

2223
/**
2324
* AccessListener enforces access control rules.
@@ -51,6 +52,10 @@ public function __construct(TokenStorageInterface $tokenStorage, AccessDecisionM
5152
*/
5253
public function __invoke(RequestEvent $event)
5354
{
55+
if (!$event instanceof LazyResponseEvent && null === $token = $this->tokenStorage->getToken()) {
56+
throw new AuthenticationCredentialsNotFoundException('A Token was not found in the TokenStorage.');
57+
}
58+
5459
$request = $event->getRequest();
5560

5661
list($attributes) = $this->map->getPatterns($request);
@@ -59,7 +64,7 @@ public function __invoke(RequestEvent $event)
5964
return;
6065
}
6166

62-
if (null === $token = $this->tokenStorage->getToken()) {
67+
if ($event instanceof LazyResponseEvent && null === $token = $this->tokenStorage->getToken()) {
6368
throw new AuthenticationCredentialsNotFoundException('A Token was not found in the TokenStorage.');
6469
}
6570

‎src/Symfony/Component/Security/Http/Tests/Firewall/AccessListenerTest.php

Copy file name to clipboardExpand all lines: src/Symfony/Component/Security/Http/Tests/Firewall/AccessListenerTest.php
+2-1Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@
1818
use Symfony\Component\Security\Core\Authentication\Token\Storage\TokenStorageInterface;
1919
use Symfony\Component\Security\Core\Authorization\AccessDecisionManagerInterface;
2020
use Symfony\Component\Security\Http\AccessMapInterface;
21+
use Symfony\Component\Security\Http\Event\LazyResponseEvent;
2122
use Symfony\Component\Security\Http\Firewall\AccessListener;
2223

2324
class AccessListenerTest extends TestCase
@@ -219,7 +220,7 @@ public function testHandleWhenAccessMapReturnsEmptyAttributes()
219220
->willReturn($request)
220221
;
221222

222-
$listener($event);
223+
$listener(new LazyResponseEvent($event));
223224
}
224225

225226
public function testHandleWhenTheSecurityTokenStorageHasNoToken()

0 commit comments

Comments
0 (0)
Morty Proxy This is a proxified and sanitized view of the page, visit original site.