Closed
Description
Symfony version(s) affected: 5.2.1
Description
SwitchUserListener doesn't automatically refresh the user in the original token. This means anything that uses that user on switch user requests won't be able to assume that it has been refreshed, and it can cause problems with things like Doctrine relations which only work correctly after the user has been refreshed.
How to reproduce
- Clone https://github.com/AndrolGenhald/symfony_bug_39991.
composer install
bin/console doctrine:migrations:migrate -q
- Run preferred web server, such as
php -S localhost:8000 -t public
- Login with "user_1", "password"
- Impersonate user_2_*
- Impersonate user_3_*
- Exception is thrown in CanImpersonateVoter