diogo
/
symfony
Archived
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

[Security] Check if firewall is stateless before checking for session/previous session

This commit is contained in:
Koen Reiniers 2020-03-23 11:51:31 +01:00 committed by Nicolas Grekas
parent 5b5b61f425
commit 9bb1230525
2 changed files with 20 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/Symfony/Component/Security/Guard/GuardAuthenticatorHandler.php
View File

@ -134,7 +134,7 @@ class GuardAuthenticatorHandler
private function migrateSession(Request $request, TokenInterface $token, $providerKey)
{
if (!$this->sessionStrategy || !$request->hasSession() || !$request->hasPreviousSession() || \in_array($providerKey, $this->statelessProviderKeys, true)) {
if (\in_array($providerKey, $this->statelessProviderKeys, true) || !$this->sessionStrategy || !$request->hasSession() || !$request->hasPreviousSession()) {
return;
}

19
src/Symfony/Component/Security/Guard/Tests/GuardAuthenticatorHandlerTest.php
View File

@ -149,6 +149,25 @@ class GuardAuthenticatorHandlerTest extends TestCase
$handler->authenticateWithToken($this->token, $this->request, 'some_provider_key');
}
/**
* @requires function \Symfony\Component\HttpFoundation\Request::setSessionFactory
*/
public function testSessionIsNotInstantiatedOnStatelessFirewall()
{
$sessionFactory = $this->getMockBuilder(\stdClass::class)
->setMethods(['__invoke'])
->getMock();
$sessionFactory->expects($this->never())
->method('__invoke');
$this->request->setSessionFactory($sessionFactory);
$handler = new GuardAuthenticatorHandler($this->tokenStorage, $this->dispatcher, ['stateless_provider_key']);
$handler->setSessionAuthenticationStrategy($this->sessionStrategy);
$handler->authenticateWithToken($this->token, $this->request, 'stateless_provider_key');
}
protected function setUp()
{
$this->tokenStorage = $this->getMockBuilder('Symfony\Component\Security\Core\Authentication\Token\Storage\TokenStorageInterface')->getMock();