Closed
Description
| Q | A |
|---|---|
| Bug report? | yes |
| Feature request? | no |
| BC Break report? | no |
| RFC? | no |
| Symfony version | 3.4.4 |
To check if a user has changed in a security context, my User entity implements the EquatableInterface. Because the logout_on_user_change is set to true, I expect the user to be logged out if the isEqualTo method returns false. This is indeed the case, but only the session cookie seems to be reset and not the REMEMBERME cookie, causing the user to be logged back in. I consider this to be a security flaw and not consistent with manually logging out (e.g. /logout URL), in which the REMEMBERME cookie does get deleted.
It seems like an issue for this already exists, but was closed as fixed in 3.4.0.
This is from my log files:
[2018-03-01 01:43:10] request.INFO: Matched route "account". {"route":"account","route_parameters":{"_controller":"AppBundle\\Controller\\AccountController::accountAction","_route":"account"},"request_uri":"https://example.com/account","method":"GET"} []
[2018-03-01 01:43:10] security.DEBUG: Read existing security token from the session. {"key":"_security_main","token_class":"Symfony\\Component\\Security\\Core\\Authentication\\Token\\RememberMeToken"} []
[2018-03-01 01:43:10] security.DEBUG: Token was deauthenticated after trying to refresh it. {"username":"user@email.com","provider":"Symfony\\Bridge\\Doctrine\\Security\\User\\EntityUserProvider"} []
[2018-03-01 01:43:10] security.DEBUG: Remember-me cookie detected. [] []
[2018-03-01 01:43:10] security.INFO: Remember-me cookie accepted. [] []
[2018-03-01 01:43:10] security.DEBUG: Populated the token storage with a remember-me token. [] []
[2018-03-01 01:43:10] security.DEBUG: Stored the security token in the session. {"key":"_security_main"} []
My security config is pretty basic:
security:
encoders:
AppBundle\Entity\User:
algorithm: bcrypt
cost: 12
firewalls:
api:
pattern: ^/api
stateless: true
anonymous: ~
http_basic:
provider: user_entity_provider
realm: API
content:
pattern: ^/content
security: false
dev:
pattern: ^/_profiler
security: false
main:
provider: user_entity_provider
stateless: false
anonymous: ~
logout_on_user_change: true
form_login:
login_path: /account/sign-in
check_path: /account/sign-in
default_target_path: /
csrf_token_generator: security.csrf.token_manager
logout:
path: /account/sign-out
target: /
remember_me:
name: REMEMBERME
secret: '%secret%'
lifetime: 31536000 # 1 year.
providers:
user_entity_provider:
entity:
class: AppBundle:User
property: emailAddress