[Securitiy] do not overwrite already stored tokens (i.e. from the session)

stlrnz · stlrnz · commit 243937ad1812 · 2021-11-11T09:17:46.000+01:00
diff --git a/src/Symfony/Component/Security/Http/Authenticator/AbstractPreAuthenticatedAuthenticator.php b/src/Symfony/Component/Security/Http/Authenticator/AbstractPreAuthenticatedAuthenticator.php
@@ -59,6 +59,11 @@ abstract protected function extractUsername(Request $request): ?string;
 
     public function supports(Request $request): ?bool
     {
+        // do not overwrite already stored tokens (i.e. from the session)
+        if (null !== $this->tokenStorage->getToken()) {
+            return false;
+        }
+
         try {
             $username = $this->extractUsername($request);
         } catch (BadCredentialsException $e) {
diff --git a/src/Symfony/Component/Security/Http/Tests/Authenticator/RemoteUserAuthenticatorTest.php b/src/Symfony/Component/Security/Http/Tests/Authenticator/RemoteUserAuthenticatorTest.php
@@ -13,13 +13,24 @@
 
 use PHPUnit\Framework\TestCase;
 use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\Security\Core\Authentication\Token\PreAuthenticatedToken;
 use Symfony\Component\Security\Core\Authentication\Token\Storage\TokenStorage;
 use Symfony\Component\Security\Core\User\InMemoryUser;
 use Symfony\Component\Security\Core\User\InMemoryUserProvider;
 use Symfony\Component\Security\Http\Authenticator\RemoteUserAuthenticator;
 
 class RemoteUserAuthenticatorTest extends TestCase
 {
+    public function testSupportsTokenStorageWithToken()
+    {
+        $tokenStorage = new TokenStorage();
+        $tokenStorage->setToken(new PreAuthenticatedToken('username', 'credentials', 'main'));
+
+        $authenticator = new RemoteUserAuthenticator(new InMemoryUserProvider(), $tokenStorage, 'main');
+
+        $this->assertFalse($authenticator->supports(Request::create('/')));
+    }
+
     /**
      * @dataProvider provideAuthenticators
      */
