Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Appearance settings

Commit 2d69374

Browse filesBrowse files
robfrawleyrobfrawley
committed
add sensitive authentication success event (includes user credentials) to complement existing authentication success event in the authentication provider manager handling
1 parent 4a7e6fa commit 2d69374
Copy full SHA for 2d69374

File tree

5 files changed

+85
-11
lines changed
Filter options

5 files changed

+85
-11
lines changed

‎src/Symfony/Component/Security/Core/Authentication/AuthenticationProviderManager.php

Copy file name to clipboardExpand all lines: src/Symfony/Component/Security/Core/Authentication/AuthenticationProviderManager.php
+9Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@
1515
use Symfony\Component\Security\Core\Event\AuthenticationEvent;
1616
use Symfony\Component\Security\Core\AuthenticationEvents;
1717
use Symfony\Component\EventDispatcher\EventDispatcherInterface;
18+
use Symfony\Component\Security\Core\Event\AuthenticationSensitiveEvent;
1819
use Symfony\Component\Security\Core\Exception\AccountStatusException;
1920
use Symfony\Component\Security\Core\Exception\AuthenticationException;
2021
use Symfony\Component\Security\Core\Exception\ProviderNotFoundException;
@@ -32,6 +33,10 @@ class AuthenticationProviderManager implements AuthenticationManagerInterface
3233
{
3334
private $providers;
3435
private $eraseCredentials;
36+
37+
/**
38+
* @var EventDispatcherInterface
39+
*/
3540
private $eventDispatcher;
3641

3742
/**
@@ -88,6 +93,10 @@ public function authenticate(TokenInterface $token)
8893
}
8994

9095
if (null !== $result) {
96+
if (null !== $this->eventDispatcher) {
97+
$this->eventDispatcher->dispatch(AuthenticationEvents::AUTHENTICATION_SUCCESS_SENSITIVE, new AuthenticationSensitiveEvent($result));
98+
}
99+
91100
if (true === $this->eraseCredentials) {
92101
$result->eraseCredentials();
93102
}

‎src/Symfony/Component/Security/Core/AuthenticationEvents.php

Copy file name to clipboardExpand all lines: src/Symfony/Component/Security/Core/AuthenticationEvents.php
+23-1Lines changed: 23 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,9 +13,31 @@
1313

1414
final class AuthenticationEvents
1515
{
16+
/**
17+
* The AUTHENTICATION_SUCCESS_SENSITIVE event occurs after a user is
18+
* authenticated by one provider and is dispatched immediately prior to
19+
* the associated AUTHENTICATION_SUCCESS event.
20+
*
21+
* This event contains user credentials and other sensitive data. This
22+
* enables operations such as password rehashing and other credentials-
23+
* aware actions, and provides an explicit distinction between code that
24+
* has access to sensitive user data and code that does not; use the
25+
* existing AUTHENTICATION_SUCCESS event for the latter case.
26+
*
27+
* @Event("Symfony\Component\Security\Core\Event\AuthenticationSensitiveEvent")
28+
*/
29+
const AUTHENTICATION_SUCCESS_SENSITIVE = 'security.authentication.success_sensitive';
30+
1631
/**
1732
* The AUTHENTICATION_SUCCESS event occurs after a user is authenticated
18-
* by one provider.
33+
* by one provider and is dispatched immediately after to the associated
34+
* AUTHENTICATION_SUCCESS_SENSITIVE event.
35+
*
36+
* This event is stripped of user credentials and other sensitive data by
37+
* default, and provides an explicit distinction between code that is
38+
* shielded from the responsibility of handling sensitive user data and
39+
* code that is not; use the new AUTHENTICATION_SUCCESS_SENSITIVE event
40+
* for the latter case.
1941
*
2042
* @Event("Symfony\Component\Security\Core\Event\AuthenticationEvent")
2143
*/

‎src/Symfony/Component/Security/Core/Event/AuthenticationEvent.php

Copy file name to clipboardExpand all lines: src/Symfony/Component/Security/Core/Event/AuthenticationEvent.php
+1-1Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ public function __construct(TokenInterface $token)
2828
$this->authenticationToken = $token;
2929
}
3030

31-
public function getAuthenticationToken()
31+
public function getAuthenticationToken(): TokenInterface
3232
{
3333
return $this->authenticationToken;
3434
}

‎src/Symfony/Component/Security/Core/Event/AuthenticationSensitiveEvent.php

Copy file name to clipboard
+21Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
<?php
2+
3+
/*
4+
* This file is part of the Symfony package.
5+
*
6+
* (c) Fabien Potencier <fabien@symfony.com>
7+
*
8+
* For the full copyright and license information, please view the LICENSE
9+
* file that was distributed with this source code.
10+
*/
11+
12+
namespace Symfony\Component\Security\Core\Event;
13+
14+
/**
15+
* This is an authentication event that includes sensitive data.
16+
*
17+
* @author Rob Frawley 2nd <rmf@src.run>
18+
*/
19+
class AuthenticationSensitiveEvent extends AuthenticationEvent
20+
{
21+
}

‎src/Symfony/Component/Security/Core/Tests/Authentication/AuthenticationProviderManagerTest.php

Copy file name to clipboardExpand all lines: src/Symfony/Component/Security/Core/Tests/Authentication/AuthenticationProviderManagerTest.php
+31-9Lines changed: 31 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -12,10 +12,13 @@
1212
namespace Symfony\Component\Security\Core\Tests\Authentication;
1313

1414
use PHPUnit\Framework\TestCase;
15+
use Symfony\Component\EventDispatcher\EventDispatcher;
16+
use Symfony\Component\EventDispatcher\EventDispatcherInterface;
1517
use Symfony\Component\Security\Core\Authentication\AuthenticationProviderManager;
1618
use Symfony\Component\Security\Core\AuthenticationEvents;
1719
use Symfony\Component\Security\Core\Event\AuthenticationEvent;
1820
use Symfony\Component\Security\Core\Event\AuthenticationFailureEvent;
21+
use Symfony\Component\Security\Core\Event\AuthenticationSensitiveEvent;
1922
use Symfony\Component\Security\Core\Exception\ProviderNotFoundException;
2023
use Symfony\Component\Security\Core\Exception\AuthenticationException;
2124
use Symfony\Component\Security\Core\Exception\AccountStatusException;
@@ -152,26 +155,45 @@ public function testAuthenticateDispatchesAuthenticationFailureEvent()
152155
}
153156
}
154157

155-
public function testAuthenticateDispatchesAuthenticationSuccessEvent()
158+
public function testAuthenticateDispatchesAuthenticationSuccessEvents()
156159
{
157160
$token = new UsernamePasswordToken('foo', 'bar', 'key');
158161

159-
$provider = $this->getMockBuilder('Symfony\Component\Security\Core\Authentication\Provider\AuthenticationProviderInterface')->getMock();
160-
$provider->expects($this->once())->method('supports')->willReturn(true);
161-
$provider->expects($this->once())->method('authenticate')->willReturn($token);
162-
163-
$dispatcher = $this->getMockBuilder('Symfony\Component\EventDispatcher\EventDispatcherInterface')->getMock();
162+
$dispatcher = $this->getMockBuilder(EventDispatcherInterface::class)->getMock();
164163
$dispatcher
165-
->expects($this->once())
164+
->expects($this->exactly(2))
166165
->method('dispatch')
167-
->with(AuthenticationEvents::AUTHENTICATION_SUCCESS, $this->equalTo(new AuthenticationEvent($token)));
166+
->withConsecutive(array(
167+
AuthenticationEvents::AUTHENTICATION_SUCCESS_SENSITIVE, $this->equalTo(new AuthenticationSensitiveEvent($token)),
168+
), array(
169+
AuthenticationEvents::AUTHENTICATION_SUCCESS, $this->equalTo(new AuthenticationEvent($token)),
170+
));
168171

169-
$manager = new AuthenticationProviderManager(array($provider));
172+
$manager = new AuthenticationProviderManager(array(
173+
$this->getAuthenticationProvider(true, $token),
174+
));
170175
$manager->setEventDispatcher($dispatcher);
171176

172177
$this->assertSame($token, $manager->authenticate($token));
173178
}
174179

180+
public function testAuthenticateDispatchesAuthenticationSuccessEventsWithCredentialsAvailableAndRemovedForSuccessiveDispatches()
181+
{
182+
$dispatcher = new EventDispatcher();
183+
$dispatcher->addListener(AuthenticationEvents::AUTHENTICATION_SUCCESS_SENSITIVE, function (AuthenticationSensitiveEvent $event) {
184+
$this->assertEquals('bar', $event->getAuthenticationToken()->getCredentials());
185+
});
186+
$dispatcher->addListener(AuthenticationEvents::AUTHENTICATION_SUCCESS, function (AuthenticationEvent $event) {
187+
$this->assertEquals('', $event->getAuthenticationToken()->getCredentials());
188+
});
189+
190+
$manager = new AuthenticationProviderManager(array(
191+
$this->getAuthenticationProvider(true, $token = new UsernamePasswordToken('foo', 'bar', 'key')),
192+
));
193+
$manager->setEventDispatcher($dispatcher);
194+
$manager->authenticate($token);
195+
}
196+
175197
protected function getAuthenticationProvider($supports, $token = null, $exception = null)
176198
{
177199
$provider = $this->getMockBuilder('Symfony\Component\Security\Core\Authentication\Provider\AuthenticationProviderInterface')->getMock();

0 commit comments

Comments
0 (0)
Morty Proxy This is a proxified and sanitized view of the page, visit original site.