Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit18b1c6a

Browse files
MacDadafabpot
authored andcommitted
[Security][bugfix] "Remember me" cookie cleared on logout with custom "secure"/"httponly" config options [1]
1 parent5607f71 commit18b1c6a

File tree

4 files changed

+50
-6
lines changed

4 files changed

+50
-6
lines changed

‎src/Symfony/Component/Security/Http/RememberMe/AbstractRememberMeServices.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -293,7 +293,7 @@ protected function cancelCookie(Request $request)
293293
$this->logger->debug(sprintf('Clearing remember-me cookie "%s"',$this->options['name']));
294294
}
295295

296-
$request->attributes->set(self::COOKIE_ATTR_NAME,newCookie($this->options['name'],null,1,$this->options['path'],$this->options['domain']));
296+
$request->attributes->set(self::COOKIE_ATTR_NAME,newCookie($this->options['name'],null,1,$this->options['path'],$this->options['domain'],$this->options['secure'],$this->options['httponly']));
297297
}
298298

299299
/**

‎src/Symfony/Component/Security/Tests/Http/RememberMe/AbstractRememberMeServicesTest.php‎

Lines changed: 29 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -82,16 +82,35 @@ public function testAutoLogin()
8282
$this->assertSame('fookey',$returnedToken->getProviderKey());
8383
}
8484

85-
publicfunctiontestLogout()
85+
/**
86+
* @dataProvider provideOptionsForLogout
87+
*/
88+
publicfunctiontestLogout(array$options)
8689
{
87-
$service =$this->getService(null,array('name' =>'foo','path' =>null,'domain' =>null));
90+
$service =$this->getService(null,$options);
8891
$request =newRequest();
8992
$response =newResponse();
9093
$token =$this->getMock('Symfony\Component\Security\Core\Authentication\Token\TokenInterface');
9194

9295
$service->logout($request,$response,$token);
9396

94-
$this->assertTrue($request->attributes->get(RememberMeServicesInterface::COOKIE_ATTR_NAME)->isCleared());
97+
$cookie =$request->attributes->get(RememberMeServicesInterface::COOKIE_ATTR_NAME);
98+
99+
$this->assertInstanceOf('Symfony\Component\HttpFoundation\Cookie',$cookie);
100+
$this->assertTrue($cookie->isCleared());
101+
$this->assertSame($options['name'],$cookie->getName());
102+
$this->assertSame($options['path'],$cookie->getPath());
103+
$this->assertSame($options['domain'],$cookie->getDomain());
104+
$this->assertSame($options['secure'],$cookie->isSecure());
105+
$this->assertSame($options['httponly'],$cookie->isHttpOnly());
106+
}
107+
108+
publicfunctionprovideOptionsForLogout()
109+
{
110+
returnarray(
111+
array(array('name' =>'foo','path' =>'/','domain' =>null,'secure' =>false,'httponly' =>true)),
112+
array(array('name' =>'foo','path' =>'/bar','domain' =>'baz.com','secure' =>true,'httponly' =>false)),
113+
);
95114
}
96115

97116
publicfunctiontestLoginFail()
@@ -267,6 +286,13 @@ protected function getService($userProvider = null, $options = array(), $logger
267286
$userProvider =$this->getProvider();
268287
}
269288

289+
if (!isset($options['secure'])) {
290+
$options['secure'] =false;
291+
}
292+
if (!isset($options['httponly'])) {
293+
$options['httponly'] =true;
294+
}
295+
270296
return$this->getMockForAbstractClass('Symfony\Component\Security\Http\RememberMe\AbstractRememberMeServices',array(
271297
array($userProvider),'fookey','fookey',$options,$logger,
272298
));

‎src/Symfony/Component/Security/Tests/Http/RememberMe/PersistentTokenBasedRememberMeServicesTest.php‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -180,7 +180,7 @@ public function testAutoLogin()
180180

181181
publicfunctiontestLogout()
182182
{
183-
$service =$this->getService(null,array('name' =>'foo','path' =>'/foo','domain' =>'foodomain.foo'));
183+
$service =$this->getService(null,array('name' =>'foo','path' =>'/foo','domain' =>'foodomain.foo','secure' =>true,'httponly' =>false));
184184
$request =newRequest();
185185
$request->cookies->set('foo',$this->encodeCookie(array('fooseries','foovalue')));
186186
$response =newResponse();
@@ -201,6 +201,8 @@ public function testLogout()
201201
$this->assertTrue($cookie->isCleared());
202202
$this->assertEquals('/foo',$cookie->getPath());
203203
$this->assertEquals('foodomain.foo',$cookie->getDomain());
204+
$this->assertTrue($cookie->isSecure());
205+
$this->assertFalse($cookie->isHttpOnly());
204206
}
205207

206208
publicfunctiontestLogoutSimplyIgnoresNonSetRequestCookie()
@@ -311,6 +313,13 @@ protected function getService($userProvider = null, $options = array(), $logger
311313
$userProvider =$this->getProvider();
312314
}
313315

316+
if (!isset($options['secure'])) {
317+
$options['secure'] =false;
318+
}
319+
if (!isset($options['httponly'])) {
320+
$options['httponly'] =true;
321+
}
322+
314323
returnnewPersistentTokenBasedRememberMeServices(array($userProvider),'fookey','fookey',$options,$logger,newSecureRandom(sys_get_temp_dir().'/_sf2.seed'));
315324
}
316325

‎src/Symfony/Component/Security/Tests/Http/RememberMe/TokenBasedRememberMeServicesTest.php‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -153,7 +153,7 @@ public function provideUsernamesForAutoLogin()
153153

154154
publicfunctiontestLogout()
155155
{
156-
$service =$this->getService(null,array('name' =>'foo','path' =>null,'domain' =>null));
156+
$service =$this->getService(null,array('name' =>'foo','path' =>null,'domain' =>null,'secure' =>true,'httponly' =>false));
157157
$request =newRequest();
158158
$response =newResponse();
159159
$token =$this->getMock('Symfony\Component\Security\Core\Authentication\Token\TokenInterface');
@@ -164,6 +164,8 @@ public function testLogout()
164164
$this->assertTrue($cookie->isCleared());
165165
$this->assertEquals('/',$cookie->getPath());
166166
$this->assertNull($cookie->getDomain());
167+
$this->assertTrue($cookie->isSecure());
168+
$this->assertFalse($cookie->isHttpOnly());
167169
}
168170

169171
publicfunctiontestLoginFail()
@@ -264,6 +266,13 @@ protected function getService($userProvider = null, $options = array(), $logger
264266
$userProvider =$this->getProvider();
265267
}
266268

269+
if (!isset($options['secure'])) {
270+
$options['secure'] =false;
271+
}
272+
if (!isset($options['httponly'])) {
273+
$options['httponly'] =true;
274+
}
275+
267276
$service =newTokenBasedRememberMeServices(array($userProvider),'fookey','fookey',$options,$logger);
268277

269278
return$service;

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp