Uh oh!
There was an error while loading.Please reload this page.
- Notifications
You must be signed in to change notification settings - Fork9.7k
[Security/Http] Fix compat of persistent remember-me with legacy tokens#49103
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.
Already on GitHub?Sign in to your account
[Security/Http] Fix compat of persistent remember-me with legacy tokens#49103
Uh oh!
There was an error while loading.Please reload this page.
Conversation
| } | ||
| $this->tokenProvider =$tokenProvider; | ||
| $this->tokenVerifier =$tokenVerifier; | ||
| $this->secret =$secret; |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
unused property after#49078
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
should we deprecate the constructor argument ?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
we could but not in 5.4
chalasr left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
How long should they be supported?
nicolas-grekas commentedJan 25, 2023
We can keep that logic forever, we don't really care IMHO. |
eexit commentedJan 25, 2023
Thanks for the quick fix. "repositories": [ {"_comment":"Testing: https://github.com/symfony/symfony/pull/49103","type":"git","url":"https://github.com/nicolas-grekas/symfony.git" }] Doing this command does not work: It looks like composer is ignoring your repo and I have no idea why. Thanks! |
…stentRememberMeHandler constructor (xabbuh)This PR was merged into the 6.3 branch.Discussion----------[Security] deprecate the $secret argument of the PersistentRememberMeHandler constructor| Q | A| ------------- | ---| Branch? | 6.3| Bug fix? | no| New feature? | no| Deprecations? | yes| Tickets |#49103 (comment)| License | MIT| Doc PR |Commits-------bf81d66 deprecate the $secret argument of the PersistentRememberMeHandler constructor
In#49078, we changed the format of remember-me tokens, effectively invalidating them all.
While the invalidation is intentional for signature-based remember-me handlers, persistent remember-me handlers could accept both legacy and updated tokens.
This PR fixes compat with legacy tokens for persistent remember-me handlers.