Commitbf5f901

committed

1 parent7518fea commitbf5f901Copy full SHA for bf5f901

File tree

-6

lines changed

-6

lines changed

Lines changed: 0 additions & 6 deletions

Original file line number	Diff line number	Diff line change
@@ -343,11 +343,6 @@ can also create your own :ref:`custom user provider <security-custom-user-provid
`343`	`343`	it using the:class:`Symfony\\Component\\Security\\Core\\User\\UserProviderInterface`
`344`	`344`	`type-hint.`
`345`	`345`
`346`		`-..note::`
`347`		`-`
`348`		`- The maximum length allowed for the user identifier is 4096 characters to`
`349`		- prevent `session storage flooding`_ attacks.
`350`		`-`
`351`	`346`	`.. _security-encoding-user-password:`
`352`	`347`
`353`	`348`	`Registering the User: Hashing Passwords`
`@@ -2661,4 +2656,3 @@ Authorization (Denying Access)`
`2661`	`2656`	.. _`SymfonyCastsVerifyEmailBundle`:https://github.com/symfonycasts/verify-email-bundle
`2662`	`2657`	.. _`HTTP Basic authentication`:https://en.wikipedia.org/wiki/Basic_access_authentication
`2663`	`2658`	.. _`Login CSRF attacks`:https://en.wikipedia.org/wiki/Cross-site_request_forgery#Forging_login_requests
`2664`		-.. _`session storage flooding`:https://symfony.com/blog/cve-2016-4423-large-username-storage-in-session

Lines changed: 7 additions & 0 deletions

Original file line number	Diff line number	Diff line change
@@ -205,6 +205,11 @@ using :ref:`the user provider <security-user-providers>`::
`205`	`205`	`// ...`
`206`	`206`	`$passport = new Passport(new UserBadge($email), $credentials);`
`207`	`207`
	`208`	`+..note::`
	`209`	`+`
	`210`	`+ The maximum length allowed for the user identifier is 4096 characters to`
	`211`	+ prevent `session storage flooding`_ attacks.
	`212`	`+`
`208`	`213`	`..note::`
`209`	`214`
`210`	`215`	`You can optionally pass a user loader as second argument to the`
@@ -373,3 +378,5 @@ authenticator methods (e.g. ``createToken()``)::
`373`	`378`	`return new CustomOauthToken($passport->getUser(), $passport->getAttribute('scope'));`
`374`	`379`	`}`
`375`	`380`	`}`
	`381`	`+`
	`382`	+.. _`session storage flooding`:https://symfony.com/blog/cve-2016-4423-large-username-storage-in-session

Comments

(0)