symfony
diff --git a/‎src/Symfony/Component/Security/Core/User/PasswordAuthenticatedUserInterface.php
Copy file name to clipboardExpand all lines: src/Symfony/Component/Security/Core/User/PasswordAuthenticatedUserInterface.php
+18Lines changed: 18 additions & 0 deletions b/‎src/Symfony/Component/Security/Core/User/PasswordAuthenticatedUserInterface.php
Copy file name to clipboardExpand all lines: src/Symfony/Component/Security/Core/User/PasswordAuthenticatedUserInterface.php
+18Lines changed: 18 additions & 0 deletions
diff --git a/‎src/Symfony/Component/Security/Http/Firewall/ContextListener.php
Copy file name to clipboardExpand all lines: src/Symfony/Component/Security/Http/Firewall/ContextListener.php
+9-4Lines changed: 9 additions & 4 deletions b/‎src/Symfony/Component/Security/Http/Firewall/ContextListener.php
Copy file name to clipboardExpand all lines: src/Symfony/Component/Security/Http/Firewall/ContextListener.php
+9-4Lines changed: 9 additions & 4 deletions
diff --git a/‎src/Symfony/Component/Security/Http/Tests/Firewall/ContextListenerTest.php
Copy file name to clipboardExpand all lines: src/Symfony/Component/Security/Http/Tests/Firewall/ContextListenerTest.php
+6-2Lines changed: 6 additions & 2 deletions b/‎src/Symfony/Component/Security/Http/Tests/Firewall/ContextListenerTest.php
Copy file name to clipboardExpand all lines: src/Symfony/Component/Security/Http/Tests/Firewall/ContextListenerTest.php
+6-2Lines changed: 6 additions & 2 deletions
diff --git a/‎src/Symfony/Component/Security/Http/Tests/Fixtures/CustomUser.php
Copy file name to clipboardExpand all lines: src/Symfony/Component/Security/Http/Tests/Fixtures/CustomUser.php
+12-2Lines changed: 12 additions & 2 deletions b/‎src/Symfony/Component/Security/Http/Tests/Fixtures/CustomUser.php
Copy file name to clipboardExpand all lines: src/Symfony/Component/Security/Http/Tests/Fixtures/CustomUser.php
+12-2Lines changed: 12 additions & 2 deletions
@@ -14,6 +14,24 @@
 /**
  * For users that can be authenticated using a password.
  *
+ * The __serialize/__unserialize() magic methods can be used on the user class to prevent the password hash from being
+ * stored in the session. If the password is not stored at all in the session, getPassword() should return null after
+ * unserialization, and then, changing the user's password won't invalidate its sessions.
+ * In order to invalidate the user sessions while not storing the password hash in the session, it's also possible to
+ * hash the password hash before serializing it; xxh3 is the only algorithm supported. For example:
+ *
+ *     public function __serialize(): array
+ *     {
+ *         return [$this->username, hash('xxh3', $this->password)];
+ *     }
+ *
+ *     public function __unserialize(array $data): void
+ *     {
+ *         [$this->username, $this->password] = $data;
+ *     }
+ *
+ * Implement EquatableInteface if you need another logic.
+ *
  * @author Robin Chalas <robin.chalas@gmail.com>
  * @author Wouter de Jong <wouter@wouterj.nl>
  */
 
@@ -288,18 +288,23 @@ private static function hasUserChanged(UserInterface $originalUser, TokenInterfa
         }
 
         if ($originalUser instanceof PasswordAuthenticatedUserInterface || $refreshedUser instanceof PasswordAuthenticatedUserInterface) {
-            if (!$originalUser instanceof PasswordAuthenticatedUserInterface
-                || !$refreshedUser instanceof PasswordAuthenticatedUserInterface
-                || $refreshedUser->getPassword() !== ($originalUser->getPassword() ?? $refreshedUser->getPassword())
+            if (!$originalUser instanceof PasswordAuthenticatedUserInterface || !$refreshedUser instanceof PasswordAuthenticatedUserInterface) {
+                return true;
+            }
+
+            if (null !== ($originalPassword = $originalUser->getPassword())
+                && ($refreshedPassword = $refreshedUser->getPassword()) !== $originalPassword
+                && (16 !== \strlen($originalPassword) || hash('xxh3', $refreshedPassword ?? $originalPassword) !== $originalPassword)
             ) {
                 return true;
             }
 
+
             if ($originalUser instanceof LegacyPasswordAuthenticatedUserInterface xor $refreshedUser instanceof LegacyPasswordAuthenticatedUserInterface) {
                 return true;
             }
 
-            if ($originalUser instanceof LegacyPasswordAuthenticatedUserInterface && $refreshedUser instanceof LegacyPasswordAuthenticatedUserInterface && $originalUser->getSalt() !== $refreshedUser->getSalt()) {
+            if ($originalUser instanceof LegacyPasswordAuthenticatedUserInterface && $originalUser->getSalt() !== $refreshedUser->getSalt()) {
                 return true;
             }
         }
 
@@ -352,9 +352,13 @@ public function testOnKernelResponseRemoveListener()
         $this->assertEmpty($dispatcher->getListeners());
     }
 
-    public function testRemovingPasswordFromSessionDoesntInvalidateTheToken()
+    /**
+     * @testWith [true]
+     *           [false]
+     */
+    public function testNullOrHashedPasswordInSessionDoesntInvalidateTheToken(bool $hashPassword)
     {
-        $user = new CustomUser('user', ['ROLE_USER'], 'pass');
+        $user = new CustomUser('user', ['ROLE_USER'], 'pass', $hashPassword);
 
         $userProvider = $this->createMock(UserProviderInterface::class);
         $userProvider->expects($this->once())
 
@@ -19,7 +19,8 @@ final class CustomUser implements UserInterface, PasswordAuthenticatedUserInterf
     public function __construct(
         private string $username,
         private array $roles,
-        private ?string $password = null,
+        private ?string $password,
+        private bool $hashPassword,
     ) {
     }
 
@@ -44,6 +45,15 @@ public function eraseCredentials(): void
 
     public function __serialize(): array
     {
-        return [\sprintf("\0%s\0username", self::class) => $this->username];
+        $data = (array) $this;
+        $passwordKey = \sprintf("\0%s\0password", self::class);
+
+        if ($this->hashPassword) {
+            $data[$passwordKey] = hash('xxh3', $this->password);
+        } else {
+            unset($data[$passwordKey]);
+        }
+
+        return $data;
     }
 }
Original file line number	Diff line number	Diff line change
`@@ -288,18 +288,23 @@ private static function hasUserChanged(UserInterface $originalUser, TokenInterfa`
`288`	`288`	`}`
`289`	`289`
`290`	`290`	`if ($originalUser instanceof PasswordAuthenticatedUserInterface \|\| $refreshedUser instanceof PasswordAuthenticatedUserInterface) {`
`291`		`- if (!$originalUser instanceof PasswordAuthenticatedUserInterface`
`292`		`- \|\| !$refreshedUser instanceof PasswordAuthenticatedUserInterface`
`293`		`- \|\| $refreshedUser->getPassword() !== ($originalUser->getPassword() ?? $refreshedUser->getPassword())`
	`291`	`+ if (!$originalUser instanceof PasswordAuthenticatedUserInterface \|\| !$refreshedUser instanceof PasswordAuthenticatedUserInterface) {`
	`292`	`+ return true;`
	`293`	`+ }`
	`294`	`+`
	`295`	`+ if (null !== ($originalPassword = $originalUser->getPassword())`
	`296`	`+ && ($refreshedPassword = $refreshedUser->getPassword()) !== $originalPassword`
	`297`	`+ && (16 !== \strlen($originalPassword) \|\| hash('xxh3', $refreshedPassword ?? $originalPassword) !== $originalPassword)`
`294`	`298`	`) {`
`295`	`299`	`return true;`
`296`	`300`	`}`
`297`	`301`
	`302`	`+`
`298`	`303`	`if ($originalUser instanceof LegacyPasswordAuthenticatedUserInterface xor $refreshedUser instanceof LegacyPasswordAuthenticatedUserInterface) {`
`299`	`304`	`return true;`
`300`	`305`	`}`
`301`	`306`
`302`		`- if ($originalUser instanceof LegacyPasswordAuthenticatedUserInterface && $refreshedUser instanceof LegacyPasswordAuthenticatedUserInterface && $originalUser->getSalt() !== $refreshedUser->getSalt()) {`
	`307`	`+ if ($originalUser instanceof LegacyPasswordAuthenticatedUserInterface && $originalUser->getSalt() !== $refreshedUser->getSalt()) {`
`303`	`308`	`return true;`
`304`	`309`	`}`
`305`	`310`	`}`