Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Appearance settings

Commit b5103a2

Browse filesBrowse files
fabpotfabpot
committed
feature #24335 [Security][SecurityBundle] Deprecate the HTTP digest auth (ogizanagi)
This PR was merged into the 3.4 branch. Discussion ---------- [Security][SecurityBundle] Deprecate the HTTP digest auth | Q | A | ------------- | --- | Branch? | 3.4 | Bug fix? | no | New feature? | no <!-- don't forget updating src/**/CHANGELOG.md files --> | BC breaks? | no | Deprecations? | yes <!-- don't forget updating UPGRADE-*.md files --> | Tests pass? | yes | Fixed tickets | #24325 <!-- #-prefixed issue number(s), if any --> | License | MIT | Doc PR | N/A See #24336 for the removal PR on master. Commits ------- 11fe79d [Security][SecurityBundle] Deprecate the HTTP digest auth
2 parents 084e49f + 11fe79d commit b5103a2
Copy full SHA for b5103a2
Expand file treeCollapse file tree

22 files changed

+453
-9
lines changed

‎UPGRADE-3.4.md

Copy file name to clipboardExpand all lines: UPGRADE-3.4.md
+10Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -270,6 +270,13 @@ Profiler
270270

271271
* The `profiler.matcher` option has been deprecated.
272272

273+
Security
274+
--------
275+
276+
* Deprecated the HTTP digest authentication: `NonceExpiredException`,
277+
`DigestAuthenticationListener` and `DigestAuthenticationEntryPoint` will be
278+
removed in 4.0. Use another authentication system like `http_basic` instead.
279+
273280
SecurityBundle
274281
--------------
275282

@@ -290,6 +297,9 @@ SecurityBundle
290297
* Added `logout_on_user_change` to the firewall options. This config item will
291298
trigger a logout when the user has changed. Should be set to true to avoid
292299
deprecations in the configuration.
300+
301+
* Deprecated the HTTP digest authentication: `HttpDigestFactory` will be removed in 4.0.
302+
Use another authentication system like `http_basic` instead.
293303

294304
Translation
295305
-----------

‎UPGRADE-4.0.md

Copy file name to clipboardExpand all lines: UPGRADE-4.0.md
+7Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -652,6 +652,10 @@ Security
652652
* Calling `ContextListener::setLogoutOnUserChange(false)` won't have any
653653
effect anymore.
654654

655+
* Removed the HTTP digest authentication system. The `NonceExpiredException`,
656+
`DigestAuthenticationListener` and `DigestAuthenticationEntryPoint` classes
657+
have been removed. Use another authentication system like `http_basic` instead.
658+
655659
SecurityBundle
656660
--------------
657661

@@ -672,6 +676,9 @@ SecurityBundle
672676

673677
* The firewall option `logout_on_user_change` is now always true, which will
674678
trigger a logout if the user changes between requests.
679+
680+
* Removed the HTTP digest authentication system. The `HttpDigestFactory` class
681+
has been removed. Use another authentication system like `http_basic` instead.
675682

676683
Serializer
677684
----------

‎src/Symfony/Bundle/SecurityBundle/CHANGELOG.md

Copy file name to clipboardExpand all lines: src/Symfony/Bundle/SecurityBundle/CHANGELOG.md
+1Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@ CHANGELOG
1616
* Added `logout_on_user_change` to the firewall options. This config item will
1717
trigger a logout when the user has changed. Should be set to true to avoid
1818
deprecations in the configuration.
19+
* deprecated HTTP digest authentication
1920

2021
3.3.0
2122
-----

‎src/Symfony/Bundle/SecurityBundle/DependencyInjection/Security/Factory/HttpDigestFactory.php

Copy file name to clipboardExpand all lines: src/Symfony/Bundle/SecurityBundle/DependencyInjection/Security/Factory/HttpDigestFactory.php
+10Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,9 +20,18 @@
2020
* HttpDigestFactory creates services for HTTP digest authentication.
2121
*
2222
* @author Fabien Potencier <fabien@symfony.com>
23+
*
24+
* @deprecated since 3.4, to be removed in 4.0
2325
*/
2426
class HttpDigestFactory implements SecurityFactoryInterface
2527
{
28+
public function __construct($triggerDeprecation = true)
29+
{
30+
if ($triggerDeprecation) {
31+
@trigger_error(sprintf('The %s class and the whole HTTP digest authentication system is deprecated since 3.4 and will be removed in 4.0.', __CLASS__), E_USER_DEPRECATED);
32+
}
33+
}
34+
2635
public function create(ContainerBuilder $container, $id, $config, $userProvider, $defaultEntryPoint)
2736
{
2837
$provider = 'security.authentication.provider.dao.'.$id;
@@ -59,6 +68,7 @@ public function getKey()
5968
public function addConfiguration(NodeDefinition $node)
6069
{
6170
$node
71+
->setDeprecated('The HTTP digest authentication is deprecated since 3.4 and will be removed in 4.0.')
6272
->children()
6373
->scalarNode('provider')->end()
6474
->scalarNode('realm')->defaultValue('Secured Area')->end()

‎src/Symfony/Bundle/SecurityBundle/SecurityBundle.php

Copy file name to clipboardExpand all lines: src/Symfony/Bundle/SecurityBundle/SecurityBundle.php
+1-1Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,7 @@ public function build(ContainerBuilder $container)
4747
$extension->addSecurityListenerFactory(new JsonLoginFactory());
4848
$extension->addSecurityListenerFactory(new HttpBasicFactory());
4949
$extension->addSecurityListenerFactory(new HttpBasicLdapFactory());
50-
$extension->addSecurityListenerFactory(new HttpDigestFactory());
50+
$extension->addSecurityListenerFactory(new HttpDigestFactory(false));
5151
$extension->addSecurityListenerFactory(new RememberMeFactory());
5252
$extension->addSecurityListenerFactory(new X509Factory());
5353
$extension->addSecurityListenerFactory(new RemoteUserFactory());

‎src/Symfony/Bundle/SecurityBundle/Tests/DependencyInjection/CompleteConfigurationTest.php

Copy file name to clipboardExpand all lines: src/Symfony/Bundle/SecurityBundle/Tests/DependencyInjection/CompleteConfigurationTest.php
+125Lines changed: 125 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -86,6 +86,131 @@ public function testFirewalls()
8686
$configs[0][2] = strtolower($configs[0][2]);
8787
$configs[2][2] = strtolower($configs[2][2]);
8888

89+
$this->assertEquals(array(
90+
array(
91+
'simple',
92+
'security.user_checker',
93+
'security.request_matcher.6tndozi',
94+
false,
95+
),
96+
array(
97+
'secure',
98+
'security.user_checker',
99+
null,
100+
true,
101+
true,
102+
'security.user.provider.concrete.default',
103+
null,
104+
'security.authentication.form_entry_point.secure',
105+
null,
106+
null,
107+
array(
108+
'logout',
109+
'switch_user',
110+
'x509',
111+
'remote_user',
112+
'form_login',
113+
'http_basic',
114+
'remember_me',
115+
'anonymous',
116+
),
117+
array(
118+
'parameter' => '_switch_user',
119+
'role' => 'ROLE_ALLOWED_TO_SWITCH',
120+
),
121+
),
122+
array(
123+
'host',
124+
'security.user_checker',
125+
'security.request_matcher.and0kk1',
126+
true,
127+
false,
128+
'security.user.provider.concrete.default',
129+
'host',
130+
'security.authentication.basic_entry_point.host',
131+
null,
132+
null,
133+
array(
134+
'http_basic',
135+
'anonymous',
136+
),
137+
null,
138+
),
139+
array(
140+
'with_user_checker',
141+
'app.user_checker',
142+
null,
143+
true,
144+
false,
145+
'security.user.provider.concrete.default',
146+
'with_user_checker',
147+
'security.authentication.basic_entry_point.with_user_checker',
148+
null,
149+
null,
150+
array(
151+
'http_basic',
152+
'anonymous',
153+
),
154+
null,
155+
),
156+
), $configs);
157+
158+
$this->assertEquals(array(
159+
array(),
160+
array(
161+
'security.channel_listener',
162+
'security.logout_listener.secure',
163+
'security.authentication.listener.x509.secure',
164+
'security.authentication.listener.remote_user.secure',
165+
'security.authentication.listener.form.secure',
166+
'security.authentication.listener.basic.secure',
167+
'security.authentication.listener.rememberme.secure',
168+
'security.authentication.listener.anonymous.secure',
169+
'security.authentication.switchuser_listener.secure',
170+
'security.access_listener',
171+
),
172+
array(
173+
'security.channel_listener',
174+
'security.context_listener.0',
175+
'security.authentication.listener.basic.host',
176+
'security.authentication.listener.anonymous.host',
177+
'security.access_listener',
178+
),
179+
array(
180+
'security.channel_listener',
181+
'security.context_listener.1',
182+
'security.authentication.listener.basic.with_user_checker',
183+
'security.authentication.listener.anonymous.with_user_checker',
184+
'security.access_listener',
185+
),
186+
), $listeners);
187+
188+
$this->assertFalse($container->hasAlias('Symfony\Component\Security\Core\User\UserCheckerInterface', 'No user checker alias is registered when custom user checker services are registered'));
189+
}
190+
191+
/**
192+
* @group legacy
193+
*/
194+
public function testFirewallsWithDigest()
195+
{
196+
$container = $this->getContainer('container1_with_digest');
197+
$arguments = $container->getDefinition('security.firewall.map')->getArguments();
198+
$listeners = array();
199+
$configs = array();
200+
foreach (array_keys($arguments[1]->getValues()) as $contextId) {
201+
$contextDef = $container->getDefinition($contextId);
202+
$arguments = $contextDef->getArguments();
203+
$listeners[] = array_map('strval', $arguments['index_0']->getValues());
204+
205+
$configDef = $container->getDefinition((string) $arguments['index_2']);
206+
$configs[] = array_values($configDef->getArguments());
207+
}
208+
209+
// the IDs of the services are case sensitive or insensitive depending on
210+
// the Symfony version. Transform them to lowercase to simplify tests.
211+
$configs[0][2] = strtolower($configs[0][2]);
212+
$configs[2][2] = strtolower($configs[2][2]);
213+
89214
$this->assertEquals(array(
90215
array(
91216
'simple',

‎src/Symfony/Bundle/SecurityBundle/Tests/DependencyInjection/Fixtures/php/container1.php

Copy file name to clipboardExpand all lines: src/Symfony/Bundle/SecurityBundle/Tests/DependencyInjection/Fixtures/php/container1.php
-1Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -64,7 +64,6 @@
6464
'simple' => array('pattern' => '/login', 'security' => false),
6565
'secure' => array('stateless' => true,
6666
'http_basic' => true,
67-
'http_digest' => array('secret' => 'TheSecret'),
6867
'form_login' => true,
6968
'anonymous' => true,
7069
'switch_user' => true,

‎src/Symfony/Bundle/SecurityBundle/Tests/DependencyInjection/Fixtures/php/container1_with_digest.php

Copy file name to clipboard
+105Lines changed: 105 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,105 @@
1+
<?php
2+
3+
$container->loadFromExtension('security', array(
4+
'acl' => array(),
5+
'encoders' => array(
6+
'JMS\FooBundle\Entity\User1' => 'plaintext',
7+
'JMS\FooBundle\Entity\User2' => array(
8+
'algorithm' => 'sha1',
9+
'encode_as_base64' => false,
10+
'iterations' => 5,
11+
),
12+
'JMS\FooBundle\Entity\User3' => array(
13+
'algorithm' => 'md5',
14+
),
15+
'JMS\FooBundle\Entity\User4' => array(
16+
'id' => 'security.encoder.foo',
17+
),
18+
'JMS\FooBundle\Entity\User5' => array(
19+
'algorithm' => 'pbkdf2',
20+
'hash_algorithm' => 'sha1',
21+
'encode_as_base64' => false,
22+
'iterations' => 5,
23+
'key_length' => 30,
24+
),
25+
'JMS\FooBundle\Entity\User6' => array(
26+
'algorithm' => 'bcrypt',
27+
'cost' => 15,
28+
),
29+
),
30+
'providers' => array(
31+
'default' => array(
32+
'memory' => array(
33+
'users' => array(
34+
'foo' => array('password' => 'foo', 'roles' => 'ROLE_USER'),
35+
),
36+
),
37+
),
38+
'digest' => array(
39+
'memory' => array(
40+
'users' => array(
41+
'foo' => array('password' => 'foo', 'roles' => 'ROLE_USER, ROLE_ADMIN'),
42+
),
43+
),
44+
),
45+
'basic' => array(
46+
'memory' => array(
47+
'users' => array(
48+
'foo' => array('password' => '0beec7b5ea3f0fdbc95d0dd47f3c5bc275da8a33', 'roles' => 'ROLE_SUPER_ADMIN'),
49+
'bar' => array('password' => '0beec7b5ea3f0fdbc95d0dd47f3c5bc275da8a33', 'roles' => array('ROLE_USER', 'ROLE_ADMIN')),
50+
),
51+
),
52+
),
53+
'service' => array(
54+
'id' => 'user.manager',
55+
),
56+
'chain' => array(
57+
'chain' => array(
58+
'providers' => array('service', 'basic'),
59+
),
60+
),
61+
),
62+
63+
'firewalls' => array(
64+
'simple' => array('pattern' => '/login', 'security' => false),
65+
'secure' => array('stateless' => true,
66+
'http_basic' => true,
67+
'http_digest' => array('secret' => 'TheSecret'),
68+
'form_login' => true,
69+
'anonymous' => true,
70+
'switch_user' => true,
71+
'x509' => true,
72+
'remote_user' => true,
73+
'logout' => true,
74+
'remember_me' => array('secret' => 'TheSecret'),
75+
'user_checker' => null,
76+
'logout_on_user_change' => true,
77+
),
78+
'host' => array(
79+
'pattern' => '/test',
80+
'host' => 'foo\\.example\\.org',
81+
'methods' => array('GET', 'POST'),
82+
'anonymous' => true,
83+
'http_basic' => true,
84+
'logout_on_user_change' => true,
85+
),
86+
'with_user_checker' => array(
87+
'user_checker' => 'app.user_checker',
88+
'anonymous' => true,
89+
'http_basic' => true,
90+
'logout_on_user_change' => true,
91+
),
92+
),
93+
94+
'access_control' => array(
95+
array('path' => '/blog/524', 'role' => 'ROLE_USER', 'requires_channel' => 'https', 'methods' => array('get', 'POST')),
96+
array('path' => '/blog/.*', 'role' => 'IS_AUTHENTICATED_ANONYMOUSLY'),
97+
array('path' => '/blog/524', 'role' => 'IS_AUTHENTICATED_ANONYMOUSLY', 'allow_if' => "token.getUsername() matches '/^admin/'"),
98+
),
99+
100+
'role_hierarchy' => array(
101+
'ROLE_ADMIN' => 'ROLE_USER',
102+
'ROLE_SUPER_ADMIN' => array('ROLE_USER', 'ROLE_ADMIN', 'ROLE_ALLOWED_TO_SWITCH'),
103+
'ROLE_REMOTE' => 'ROLE_USER,ROLE_ADMIN',
104+
),
105+
));

‎src/Symfony/Bundle/SecurityBundle/Tests/DependencyInjection/Fixtures/php/no_custom_user_checker.php

Copy file name to clipboardExpand all lines: src/Symfony/Bundle/SecurityBundle/Tests/DependencyInjection/Fixtures/php/no_custom_user_checker.php
-1Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,6 @@
1515
'secure' => array(
1616
'stateless' => true,
1717
'http_basic' => true,
18-
'http_digest' => array('secret' => 'TheSecret'),
1918
'form_login' => true,
2019
'anonymous' => true,
2120
'switch_user' => true,

‎src/Symfony/Bundle/SecurityBundle/Tests/DependencyInjection/Fixtures/xml/container1.xml

Copy file name to clipboardExpand all lines: src/Symfony/Bundle/SecurityBundle/Tests/DependencyInjection/Fixtures/xml/container1.xml
-1Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,6 @@
4949

5050
<firewall name="secure" stateless="true">
5151
<http-basic />
52-
<http-digest secret="TheSecret" />
5352
<form-login />
5453
<anonymous />
5554
<switch-user />

0 commit comments

Comments
0 (0)
Morty Proxy This is a proxified and sanitized view of the page, visit original site.