(anonymous not enabled in the config of the fullstack framework)

ExceptionListener intercept the exception and redirects to the login page

How do you render a login page without allowing anonymous access?

Any problem to render a login page occurs only if the login page is covered by a security rule (voter, access_control...) isn't it ?

I fear this change will break the behavior of apps that expect the session to be started when an access listener is enabled.

I'm not totally sure what the changes of this PR result in (I can't test it atm), so please ignore me if I'm understanding it completely wrong😅. If this PR means that the only routes that are secured are the ones behind an access_control, I'm not in favor of the changes. Security is such a sensitive thing that I consider implicitly protecting all paths is better than implicitly making all paths public. Also, changing it can be considered a BC break as there probably are apps relying on implicitly protecting all paths.

@nicolas-grekas I'm not sure to get the use-case. This change should only affect configurations where anonymous mode is disabled (but maybe I miss something). Is there other cases where AccessListener may be executed with token to null in token storage ?

@wouterj I'm agree with your thoughts and indeed if this PR breaks the current behavior, it should be closed. But (as far as I understand) the authentication mechanism (triggered by AuthenticationCredentialsNotFoundException) only occurs when there is no token in token storage. And if my tests are right, it currently doesn't work (infinite loop). In regular configurations (with anonymous mode enabled), token storage should have an AnonymousToken.

But maybe I miss an important part of how the component work. In that case your knowledge on this is very welcome :)))

I don't think this PR is correct. I did a similar change in #37314, and it was reverted in #34358 to fix #34357. See #34358 (comment)

Closing therefor. Dunno about the infinite loop (it's a configuration issue in the first place, isn't it?)