When usinganonymous: lazy, the programatic login using the guard handler is broken. As thesetToken() does not track usage, the index remains equal.

I tried fixing this more properly in e.g. theSessionStrategy::onAuthentication class, but I couldn't get it working (as$request->hasPreviousSession() returns false, the session strategy isn't called).setToken() can also not be made usage tracking afaics, because it would directly break (setToken(null) is called inContextListener).

The current fix does however look really ugly, but I can't find anything better with my minor knowledge of this session usage tracking feature. I'm open for all ideas :)

carsonbot added Status: Needs Review Security Bug labels

Apr 3, 2020

wouterj force-pushed thebug-36208/lazy-guard-manual-login branch 2 times, most recently froma7eb8fc toc1e0d9eCompare

April 3, 2020 14:12

nicolas-grekas added this to the4.4 milestone

Apr 3, 2020

Copy link

Member

nicolas-grekas commentedApr 3, 2020•
edited
Loading

setToken(null) is called in ContextListener

Can't we make setToken increment the trackerwhen $token is not null?

Copy link

MemberAuthor

wouterj commentedApr 3, 2020•
edited
Loading

Can't we make setToken increment the tracker when $token is not null?

I just tried this (as it sounds like a nice solution), but without callinggetToken() theTokenStorage::initializer() isn't called. This meansContextListener isn't called and thus usage tracking is not enabled in theUsageTrackingTokenStorage. So this can be fixed by also injecting thesessionTrackerEnabler inUsageTrackingTokenStorage. Is that preferred? (it seems a bit off, as it's then getting a closure injected call its own method)

AllowingsetToken() to call theinitializer before setting the token would completely remove the lazy feature (assetToken(null) is always called).

wouterj force-pushed thebug-36208/lazy-guard-manual-login branch fromc1e0d9e tofed965aCompare

April 3, 2020 17:04

wouterj changed the title~~[Security][Guard] Force incrementing session usage index upon programatic login~~[Security] Track session usage whenever a new token is set

Apr 3, 2020

wouterj force-pushed thebug-36208/lazy-guard-manual-login branch 2 times, most recently from20b8804 tod09adf8Compare

April 3, 2020 17:41