I choose a totally different approach, like suggested by Wouterthere

@wouterj Can you review this one please?

I'm not so sure about the 5.2 target for this PR:

• It's changing behavior, so it does need a CHANGELOG entry
• It's remove an (exception) class, I don't think we are allowed to do so in any 5.x release?

We may be able to work around (1) by only doing this in the new system. Maybe we should set a parameter (e.g.security.exception_on_no_token) that is true when the new system is used and false otherwise. Wealready have some services depending on this knowledge, by using a parameter we can also depend on it in theGuardListener.

I'm not sure we must do something more about the BC. We open a door here, we don't close one.
Previously, a user MUST put a token in the token storage to make it work.
So we can be 100% sure a token is present.
So removing this check is dead code for current code. We only allow new security system to work

But maybe, I should let the removed exception, and deprecate it...

We open a door here, we don't close one.

Looking at the code, I agree here. This stops throwing an undocumented exception, which is fine for me as a bugfix.

But maybe, I should let the removed exception, and deprecate it...

I think so :) it's a hard break, we can do it smoothly on 5.x.

What I was meaning is that expressions now need to handletoken anduser beingnull, whereas it always wasTokenInterface andUserInterface before the changes in this PR, right?I haven't used Workflow at all, so I can't judge whether this is a blocker. On a second thought, as it only happens when using the experimental system (and it doesn't work at all for the new system), it's probably OK for a patch release.

yes and yes :) an anyway, without talking about the new security system, I think the patch is valid anyway.
When we look atwhy this exception has been added, when understand that this exception is not really required, and the new code seems more natural

no approval, not good! :) See#40201

@chalasr I know there are no approval, but the more than one month, without a clear direction of what I must do. So I do what I think is the best and I merged it 11 days later :)

Anyway, thanks for taking care of the BC