Movatterモバイル変換


[0]ホーム

URL:


Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Sign up
Appearance settings

[Security] Add passport to AuthenticationTokenCreatedEvent#40840

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.

Already on GitHub?Sign in to your account

Merged

Conversation

@scheb
Copy link
Contributor

QA
Branch?5.x
Bug fix?no
New feature?yes
Deprecations?no
LicenseMIT

This is a follow-up to my previous PR#37359, which addedAuthenticationTokenCreatedEvent to the new authenticator-based security system to inspect the security token before it becomes effective to the security system. Itadds the passport that was used to generate that token to the event, so that it can be inspected as well.

Reasoning:

  1. It makes the event more aligned with other security events (which are also providing the passport)
  2. I see valid use-cases when you'd want to look into the passport/badges to decide if you'd want to make modifications to the security token.@Seldaek mentioned to me inDocument how to bypass 2FA entirely in a given context scheb/2fa#74 that he'd like to have the ability to add a badge from his custom authenticator class, which then influences 2fa being triggered or not. Having the passport in the event would make that a straight forward task.

I would like to add this to Symfony 5.3, since@wouterj plans to stabilize the authenticator security system for that release, so I believe this is worth adding it now rather than later. The constructor change could be considered a BC break, but since authenticator system is experimental, I believe it's fair to make that change now before declaring it "stable".

Seldaek reacted with thumbs up emoji
Copy link
Member

@chalasrchalasr left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

Makes sense, thanks.

@wouterjwouterjforce-pushed theauthentication-token-created-event branch from7f0fdb0 to74196e0CompareApril 16, 2021 19:36
@wouterj
Copy link
Member

I agree, thank you Christian! (also thanks for the precise PR descriptions as always, that makes it a breeze to review the need for features you introduce!)

Sign up for freeto join this conversation on GitHub. Already have an account?Sign in to comment

Reviewers

@chalasrchalasrchalasr approved these changes

@wouterjwouterjAwaiting requested review from wouterj

Assignees

No one assigned

Projects

None yet

Milestone

5.4

Development

Successfully merging this pull request may close these issues.

4 participants

@scheb@wouterj@chalasr@carsonbot

[8]ページ先頭

©2009-2025 Movatter.jp