[Security] always check the token on non-lazy firewalls #34358
Conversation
lyrixx
commented
Nov 13, 2019
| Q | A |
|---|---|
| Branch? | 4.4 |
| Bug fix? | yes |
| New feature? | no |
| Deprecations? | no |
| Tickets | Fix #34357 |
| License | MIT |
| Doc PR |
|
isn't this breaking the support for lazy firewalls by always using the token, even when you try to disable checks for some URL patterns ? |
|
I really don't know. I open the PR to get some feedbacks... |
|
Yes, it breaks lazyness. Can you please add a test case that reproduces the situation you have? |
|
c86a43e to
70b49c7
Compare
|
@nicolas-grekas maybe lazyness should be enabled only for firewalls enabling anonymous access (as such firewalls are expected to be able to deal with cases where the user might not be forced to be actually authenticated already). The lazyness indeed breaks the previous assumption that a firewall will force to have an authenticated token on all requests even when no check is performed. And when authenticated tokens can only be created for an authenticated user and not for anonymous users, the previous implementation was implicitly adding a check on all requests. |
src/Symfony/Bundle/SecurityBundle/Tests/Functional/AnoynousTest.php
Outdated
Show resolved
Hide resolved
62bf59a to
069cdb0
Compare
069cdb0 to
5dedac5
Compare
I figured out on my own :) PR ready. |
5dedac5 to
2c2632a
Compare
|
Thank you @lyrixx. |
…icolas-grekas, lyrixx) This PR was merged into the 4.4 branch. Discussion ---------- [Security] always check the token on non-lazy firewalls | Q | A | ------------- | --- | Branch? | 4.4 | Bug fix? | yes | New feature? | no | Deprecations? | no | Tickets | Fix #34357 | License | MIT | Doc PR | Commits ------- 2c2632a [SecurityBundle] add tests with empty authenticator 797450d [Security] always check the token on non-lazy firewalls
|
@nicolas-grekas Thanks you for finish it |