[FrameworkBundle] Improve KernelBrowser::loginUser() error when the user is not serializable

ousamabenyounes · nicolas-grekas · commit 1f7a71740b42 · 2026-05-04T17:33:47.000+02:00
diff --git a/KernelBrowser.php b/KernelBrowser.php
@@ -150,7 +150,15 @@ public function loginUser(object $user, string $firewallContext = 'main', array
             return $this;
         }
 
-        $session->set('_security_'.$firewallContext, serialize($token));
+        try {
+            $session->set('_security_'.$firewallContext, serialize($token));
+        } catch (\Throwable $e) {
+            $hint = method_exists($user, '__serialize')
+                ? 'Review the "__serialize()" implementation to exclude any fields that cannot or should not be persisted there'
+                : 'Implement "__serialize()"/"__unserialize()" to control what is serialized into the session, and exclude any fields that should not be persisted there';
+
+            throw new \LogicException(\sprintf('Cannot store the security token in the session: the user object of class "%s" (or one of its referenced objects) is not serializable. %s (e.g. Doctrine relations). See https://symfony.com/doc/current/security.html#understanding-how-users-are-refreshed-from-the-session for details.', $user::class, $hint), 0, $e);
+        }
         $session->save();
 
         return $this;
diff --git a/Tests/Functional/SecurityTest.php b/Tests/Functional/SecurityTest.php
@@ -13,6 +13,7 @@
 
 use PHPUnit\Framework\Attributes\DataProvider;
 use Symfony\Component\Security\Core\User\InMemoryUser;
+use Symfony\Component\Security\Core\User\UserInterface;
 
 class SecurityTest extends AbstractWebTestCase
 {
@@ -85,4 +86,83 @@ public function testLoginUserMultipleTimes()
         $client->request('GET', '/main/user_profile');
         $this->assertEquals('Welcome no-role-username!', $client->getResponse()->getContent());
     }
+
+    public function testLoginUserThrowsContextualErrorWhenUserGraphIsNotSerializable()
+    {
+        $user = new SecurityTestUserWithUnserializableField('the-username', ['ROLE_FOO']);
+        $client = $this->createClient(['test_case' => 'Security', 'root_config' => 'config.yml']);
+
+        try {
+            $client->loginUser($user);
+            $this->fail('Expected LogicException was not thrown.');
+        } catch (\LogicException $e) {
+            $this->assertStringContainsString(SecurityTestUserWithUnserializableField::class, $e->getMessage());
+            $this->assertStringContainsString('not serializable', $e->getMessage());
+            $this->assertStringContainsString('Implement "__serialize()"/"__unserialize()"', $e->getMessage());
+        }
+    }
+
+    public function testLoginUserSuggestsReviewWhenUserAlreadyImplementsSerialize()
+    {
+        $user = new SecurityTestUserWithBrokenSerialize();
+        $client = $this->createClient(['test_case' => 'Security', 'root_config' => 'config.yml']);
+
+        try {
+            $client->loginUser($user);
+            $this->fail('Expected LogicException was not thrown.');
+        } catch (\LogicException $e) {
+            $this->assertStringContainsString(SecurityTestUserWithBrokenSerialize::class, $e->getMessage());
+            $this->assertStringContainsString('Review the "__serialize()" implementation', $e->getMessage());
+        }
+    }
+}
+
+class SecurityTestUserWithUnserializableField implements UserInterface
+{
+    public \SplFileInfo $file;
+
+    public function __construct(private string $username, private array $roles = [])
+    {
+        $this->file = new \SplFileInfo(__FILE__);
+    }
+
+    public function getRoles(): array
+    {
+        return $this->roles;
+    }
+
+    public function eraseCredentials(): void
+    {
+    }
+
+    public function getUserIdentifier(): string
+    {
+        return $this->username;
+    }
+}
+
+class SecurityTestUserWithBrokenSerialize implements UserInterface
+{
+    public function getRoles(): array
+    {
+        return ['ROLE_USER'];
+    }
+
+    public function eraseCredentials(): void
+    {
+    }
+
+    public function getUserIdentifier(): string
+    {
+        return 'broken-serialize-user';
+    }
+
+    public function __serialize(): array
+    {
+        return ['file' => new \SplFileInfo(__FILE__)];
+    }
+
+    public function __unserialize(array $data): void
+    {
+    }
 }
