[Security] Deprecate UserInterface & TokenInterface's `eraseCrede…

…ntials()`
symfony · chalasr · Dec 6, 2024 · Jan 31, 2025 · e36259db5c10d2a15d1a2028681b7341c1cd3e9f · xabbuh
commit e36259db5c10d2a15d1a2028681b7341c1cd3e9f
diff --git a/UPGRADE-7.3.md b/UPGRADE-7.3.md
@@ -6,7 +6,23 @@ backward compatibility breaks. Minor backward compatibility breaks are prefixed
 `[BC BREAK]`, make sure your code is compatible with these entries before upgrading.
 Read more about this in the [Symfony documentation](https://symfony.com/doc/7.3/setup/upgrade_minor.html).

-If you're upgrading from a version below 7.1, follow the [7.2 upgrade guide](UPGRADE-7.2.md) first.
+If you're upgrading from a version below 7.2, follow the [7.2 upgrade guide](UPGRADE-7.2.md) first.
+
+Ldap
+----
+
+ * Deprecate `LdapUser::eraseCredentials()`, use `LdapUser::setPassword(null)` instead
+
+Security
+--------
+
+ * Deprecate `UserInterface::eraseCredentials()` and `TokenInterface::eraseCredentials()`,
+   use a dedicated DTO or erase credentials on your own e.g. upon `AuthenticationTokenCreatedEvent` instead
+
+SecurityBundle
+--------------
+
+ * Deprecate the `erase_credentials` config option, erase credentials on your own e.g. upon `AuthenticationTokenCreatedEvent` instead

 Console
 -------
@@ -109,3 +125,4 @@ VarDumper

 * Deprecate `ResourceCaster::castCurl()`, `ResourceCaster::castGd()` and `ResourceCaster::castOpensslX509()`
 * Mark all casters as `@internal`
+ * Deprecate the `CompiledClassMetadataFactory` and `CompiledClassMetadataCacheWarmer` classes
diff --git a/src/Symfony/Bundle/FrameworkBundle/Tests/Functional/app/CacheAttributeListener/config.yml b/src/Symfony/Bundle/FrameworkBundle/Tests/Functional/app/CacheAttributeListener/config.yml
@@ -10,6 +10,7 @@ services:
        public: true

 security:
+    erase_credentials: false
    providers:
        main:
            memory:

diff --git a/src/Symfony/Bundle/FrameworkBundle/Tests/Functional/app/Security/config.yml b/src/Symfony/Bundle/FrameworkBundle/Tests/Functional/app/Security/config.yml
@@ -8,6 +8,7 @@ services:
            - container.service_subscriber

 security:
+    erase_credentials: false
    providers:
        main:
            memory:

@@ -6,6 +6,7 @@ CHANGELOG

 * Add `Security::isGrantedForUser()` to test user authorization without relying on the session. For example, users not currently logged in, or while processing a message from a message queue
 * Add encryption support to `OidcTokenHandler` (JWE)
+ * Deprecate the `erase_credentials` config option, erase credentials on your own e.g. upon `AuthenticationTokenCreatedEvent` instead

 7.2
 ---

@@ -16,6 +16,7 @@
 use Symfony\Component\DependencyInjection\Definition;
 use Symfony\Component\DependencyInjection\Reference;
 use Symfony\Component\Ldap\Security\CheckLdapCredentialsListener;
+use Symfony\Component\Ldap\Security\EraseLdapUserCredentialsListener;
 use Symfony\Component\Ldap\Security\LdapAuthenticator;

 /**
@@ -42,6 +43,12 @@ public function createAuthenticator(ContainerBuilder $container, string $firewal
            ->addArgument(new Reference('security.ldap_locator'))
        ;

+        if (class_exists(EraseLdapUserCredentialsListener::class && !$container->getParameter('security.authentication.manager.erase_credentials'))) {
+            $container->setDefinition('security.listener.'.$key.'.'.$firewallName.'erase_ldap_credentials', new Definition(EraseLdapUserCredentialsListener::class))
+                ->addTag('kernel.event_subscriber', ['dispatcher' => 'security.event_dispatcher.'.$firewallName])
+            ;
+        }
+
        $ldapAuthenticatorId = 'security.authenticator.'.$key.'.'.$firewallName;
        $definition = $container->setDefinition($ldapAuthenticatorId, new Definition(LdapAuthenticator::class))
            ->setArguments([

@@ -135,6 +135,9 @@ public function load(array $configs, ContainerBuilder $container): void

        // set some global scalars
        $container->setParameter('security.access.denied_url', $config['access_denied_url']);
+        if (true === $config['erase_credentials']) {
+            trigger_deprecation('symfony/security-bundle', '7.3', 'Setting the "security.erase_credentials" config option to true is deprecated and won\'t have any effect in 8.0, set it to false instead and use your own erasing logic if needed.');
+        }
        $container->setParameter('security.authentication.manager.erase_credentials', $config['erase_credentials']);
        $container->setParameter('security.authentication.session_strategy.strategy', $config['session_fixation_strategy']);


@@ -103,7 +103,9 @@ public function testOnKernelRequestRecordsAuthenticatorsInfo()
            [new TraceableAuthenticator($notSupportingAuthenticator), new TraceableAuthenticator($supportingAuthenticator)],
            $tokenStorage,
            $dispatcher,
-            'main'
+            'main',
+            null,
+            false
        );

        $listener = new TraceableAuthenticatorManagerListener(new AuthenticatorManagerListener($authenticatorManager));

@@ -139,6 +139,7 @@ private function createContainer($sessionStorageOptions)

        $config = [
            'security' => [
+                'erase_credentials' => false,
                'providers' => ['some_provider' => ['id' => 'foo']],
                'firewalls' => ['some_firewall' => ['security' => false]],
            ],

@@ -34,6 +34,7 @@ protected function setUp(): void

        $this->container->registerExtension(new SecurityExtension());
        $this->container->loadFromExtension('security', [
+            'erase_credentials' => false,
            'firewalls' => ['main' => ['pattern' => '/', 'http_basic' => true]],
        ]);


@@ -56,6 +56,7 @@ protected function setUp(): void
    public function testEventIsPropagated(string $configuredEvent, string $registeredEvent)
    {
        $this->container->loadFromExtension('security', [
+            'erase_credentials' => false,
            'firewalls' => ['main' => ['pattern' => '/', 'http_basic' => true]],
        ]);

@@ -89,6 +90,7 @@ public static function providePropagatedEvents(): array
    public function testRegisterCustomListener()
    {
        $this->container->loadFromExtension('security', [
+            'erase_credentials' => false,
            'firewalls' => ['main' => ['pattern' => '/', 'http_basic' => true]],
        ]);

@@ -109,6 +111,7 @@ public function testRegisterCustomListener()
    public function testRegisterCustomSubscriber()
    {
        $this->container->loadFromExtension('security', [
+            'erase_credentials' => false,
            'firewalls' => ['main' => ['pattern' => '/', 'http_basic' => true]],
        ]);

@@ -128,6 +131,7 @@ public function testRegisterCustomSubscriber()
    public function testMultipleFirewalls()
    {
        $this->container->loadFromExtension('security', [
+            'erase_credentials' => false,
            'firewalls' => ['main' => ['pattern' => '/', 'http_basic' => true], 'api' => ['pattern' => '/api', 'http_basic' => true]],
        ]);

@@ -157,6 +161,7 @@ public function testMultipleFirewalls()
    public function testListenerAlreadySpecific()
    {
        $this->container->loadFromExtension('security', [
+            'erase_credentials' => false,
            'firewalls' => ['main' => ['pattern' => '/', 'http_basic' => true]],
        ]);


@@ -1,6 +1,7 @@
 <?php

 $container->loadFromExtension('security', [
+    'erase_credentials' => false,
    'access_decision_manager' => [
        'allow_if_all_abstain' => true,
        'allow_if_equal_granted_denied' => false,

@@ -1,6 +1,7 @@
 <?php

 $container->loadFromExtension('security', [
+    'erase_credentials' => false,
    'providers' => [
        'default' => [
            'memory' => [

@@ -1,6 +1,7 @@
 <?php

 $container->loadFromExtension('security', [
+    'erase_credentials' => false,
    'access_decision_manager' => [
        'service' => 'app.access_decision_manager',
    ],

@@ -1,6 +1,7 @@
 <?php

 $container->loadFromExtension('security', [
+    'erase_credentials' => false,
    'access_decision_manager' => [
        'service' => 'app.access_decision_manager',
        'strategy' => 'affirmative',

@@ -1,6 +1,7 @@
 <?php

 $container->loadFromExtension('security', [
+    'erase_credentials' => false,
    'access_decision_manager' => [
        'strategy_service' => 'app.custom_access_decision_strategy',
    ],

@@ -3,6 +3,7 @@
 $this->load('container1.php');

 $container->loadFromExtension('security', [
+    'erase_credentials' => false,
    'password_hashers' => [
        'JMS\FooBundle\Entity\User7' => [
            'algorithm' => 'argon2i',

@@ -3,6 +3,7 @@
 use Symfony\Component\Security\Http\Authenticator\Passport\Badge\CsrfTokenBadge;

 $container->loadFromExtension('security', [
+    'erase_credentials' => false,
    'firewalls' => [
        'main' => [
            'required_badges' => [CsrfTokenBadge::class, 'RememberMeBadge'],

@@ -3,6 +3,7 @@
 $this->load('container1.php');

 $container->loadFromExtension('security', [
+    'erase_credentials' => false,
    'password_hashers' => [
        'JMS\FooBundle\Entity\User7' => [
            'algorithm' => 'bcrypt',

@@ -1,6 +1,7 @@
 <?php

 $container->loadFromExtension('security', [
+    'erase_credentials' => false,
    'password_hashers' => [
        'JMS\FooBundle\Entity\User1' => 'plaintext',
        'JMS\FooBundle\Entity\User2' => [

@@ -1,6 +1,7 @@
 <?php

 $container->loadFromExtension('security', [
+    'erase_credentials' => false,
    'firewalls' => [
        'no_security' => [
            'pattern' => [

@@ -1,6 +1,7 @@
 <?php

 $container->loadFromExtension('security', [
+    'erase_credentials' => false,
    'providers' => [
        'default' => [
            'memory' => $memory = [

@@ -1,6 +1,7 @@
 <?php

 $container->loadFromExtension('security', [
+    'erase_credentials' => false,
    'providers' => [
        'default' => [
            'memory' => [

@@ -1,6 +1,7 @@
 <?php

 $container->loadFromExtension('security', [
+    'erase_credentials' => false,
    'providers' => [
        'default' => [
            'memory' => [

@@ -1,6 +1,7 @@
 <?php

 $container->loadFromExtension('security', [
+    'erase_credentials' => false,
    'providers' => [
        'default' => [
            'memory' => [

@@ -1,6 +1,7 @@
 <?php

 $container->loadFromExtension('security', [
+    'erase_credentials' => false,
    'providers' => [
        'default' => ['id' => 'foo'],
    ],

@@ -3,6 +3,7 @@
 $this->load('merge_import.php');

 $container->loadFromExtension('security', [
+    'erase_credentials' => false,
    'providers' => [
        'default' => ['id' => 'foo'],
    ],

@@ -1,6 +1,7 @@
 <?php

 $container->loadFromExtension('security', [
+    'erase_credentials' => false,
    'firewalls' => [
        'main' => [
            'form_login' => [

@@ -3,6 +3,7 @@
 $this->load('container1.php');

 $container->loadFromExtension('security', [
+    'erase_credentials' => false,
    'password_hashers' => [
        'JMS\FooBundle\Entity\User7' => [
            'algorithm' => 'argon2i',

@@ -1,6 +1,7 @@
 <?php

 $container->loadFromExtension('security', [
+    'erase_credentials' => false,
    'providers' => [
        'default' => [
            'memory' => [

@@ -1,6 +1,7 @@
 <?php

 $container->loadFromExtension('security', [
+    'erase_credentials' => false,
    'providers' => [
        'default' => ['id' => 'foo'],
    ],

@@ -3,6 +3,7 @@
 $this->load('container1.php');

 $container->loadFromExtension('security', [
+    'erase_credentials' => false,
    'password_hashers' => [
        'JMS\FooBundle\Entity\User7' => [
            'algorithm' => 'sodium',

@@ -7,7 +7,7 @@
        http://symfony.com/schema/dic/security
        https://symfony.com/schema/dic/security/security-1.0.xsd">

-    <config>
+    <config erase-credentials="false">
        <access-decision-manager allow-if-all-abstain="true" allow-if-equal-granted-denied="false" />

        <provider name="default">

@@ -7,7 +7,7 @@
        http://symfony.com/schema/dic/security
        https://symfony.com/schema/dic/security/security-1.0.xsd">

-    <config>
+    <config erase-credentials="false">
        <provider name="default">
            <memory>
                <user identifier="foo" password="foo" roles="ROLE_USER" />

@@ -7,7 +7,7 @@
        http://symfony.com/schema/dic/security
        https://symfony.com/schema/dic/security/security-1.0.xsd">

-    <config>
+    <config erase-credentials="false">
        <access-decision-manager service="app.access_decision_manager" />

        <provider name="default">

@@ -7,7 +7,7 @@
        http://symfony.com/schema/dic/security
        https://symfony.com/schema/dic/security/security-1.0.xsd">

-    <config>
+    <config erase-credentials="false">
        <access-decision-manager service="app.access_decision_manager" strategy="affirmative" />

        <provider name="default">

@@ -7,7 +7,7 @@
        http://symfony.com/schema/dic/security
        https://symfony.com/schema/dic/security/security-1.0.xsd">

-    <config>
+    <config erase-credentials="false">
        <access-decision-manager strategy-service="app.custom_access_decision_strategy" />

        <provider name="default">

@@ -12,7 +12,7 @@
        <import resource="container1.xml"/>
    </imports>

-    <sec:config>
+    <sec:config erase-credentials="false">
        <sec:password_hasher class="JMS\FooBundle\Entity\User7" algorithm="argon2i" memory-cost="256" time-cost="1" />
    </sec:config>


@@ -7,7 +7,7 @@
        http://symfony.com/schema/dic/security
        https://symfony.com/schema/dic/security/security-1.0.xsd">

-    <config>
+    <config erase-credentials="false">
        <firewall name="main">
            <required-badge>Symfony\Component\Security\Http\Authenticator\Passport\Badge\CsrfTokenBadge</required-badge>
            <required-badge>RememberMeBadge</required-badge>

@@ -12,7 +12,7 @@
        <import resource="container1.xml"/>
    </imports>

-    <sec:config>
+    <sec:config erase-credentials="false">
        <sec:password_hasher class="JMS\FooBundle\Entity\User7" algorithm="bcrypt" cost="15" />
    </sec:config>
-Original file line number
+Diff line change
@@ -6,7 +6,23 @@ backward compatibility breaks. Minor backward compatibility breaks are prefixed
     `[BC BREAK]`, make sure your code is compatible with these entries before upgrading.
     Read more about this in the [Symfony documentation](https://symfony.com/doc/7.3/setup/upgrade_minor.html).
-    If you're upgrading from a version below 7.1, follow the [7.2 upgrade guide](UPGRADE-7.2.md) first.
+    If you're upgrading from a version below 7.2, follow the [7.2 upgrade guide](UPGRADE-7.2.md) first.
+    Ldap
+    ----
+     * Deprecate `LdapUser::eraseCredentials()`, use `LdapUser::setPassword(null)` instead
                   nicolas-grekas marked this conversation as resolved.
              

          
            Show resolved
            Hide resolved
        

                
  
            
  

  
    
  
    
      

              Uh oh!

              
There was an error while loading. Please reload this page.
+    Security
+    --------
+     * Deprecate `UserInterface::eraseCredentials()` and `TokenInterface::eraseCredentials()`,
+       use a dedicated DTO or erase credentials on your own e.g. upon `AuthenticationTokenCreatedEvent` instead
                   nicolas-grekas marked this conversation as resolved.
              

          
            Show resolved
            Hide resolved
        

                
  
            
  

  
    
  
    
      

              Uh oh!

              
There was an error while loading. Please reload this page.
+    SecurityBundle
+    --------------
+     * Deprecate the `erase_credentials` config option, erase credentials on your own e.g. upon `AuthenticationTokenCreatedEvent` instead
                   nicolas-grekas marked this conversation as resolved.
              

          
            Show resolved
            Hide resolved
        

                
  
            
  

  
    
  
    
      

              Uh oh!

              
There was an error while loading. Please reload this page.
     Console
     -------
@@ -109,3 +125,4 @@ VarDumper
                   chalasr marked this conversation as resolved.
              

          
            Show resolved
            Hide resolved
        

                
  
            
  

  
    
  
    
      

              Uh oh!

              
There was an error while loading. Please reload this page.
      * Deprecate `ResourceCaster::castCurl()`, `ResourceCaster::castGd()` and `ResourceCaster::castOpensslX509()`
      * Mark all casters as `@internal`
+     * Deprecate the `CompiledClassMetadataFactory` and `CompiledClassMetadataCacheWarmer` classes