bug #58017 [SecurityBundle] Revert adding _stateless attribute to the request when firewall is stateless and the attribute is not already set (MatTheCat)

nicolas-grekas · nicolas-grekas · commit 643fcaef1dca · 2024-08-16T11:44:04.000+02:00
This PR was submitted for the 7.2 branch but it was merged into the 6.4 branch instead. Discussion ---------- [SecurityBundle] Revert adding `_stateless` attribute to the request when firewall is stateless and the attribute is not already set | Q | A | ------------- | --- | Branch? | 6.4 | Bug fix? | yes | New feature? | no | Deprecations? | no | Issues | Fix #50715 | License | MIT #40372 was about routes matching both stateful and stateless firewalls: you couldn’t easily configure them as stateless under a stateless firewall only. #48044 fixed it by linking these two attributes: a stateless firewall then implied a stateless request. While it can sound logical, this impacted many projects using the session while authenticating users in a stateless fashion. At last, #49997 allowed to override this behavior by explicitly configuring routes as *not* stateless. This kind of proved that #48044 was a mistake: you cannot tell a request must be stateless only because it matches a stateless firewall. As such, this PR reverts #48044 (and consequently #49997) so that configuring routes as stateless is the developers responsibility alone. It also reopens #40372, but I think this issue should be fixed in an opt-in way (with a new `firewall.stateless.with_routes` boolean configuration in the SecurityBundle e.g.). Commits ------- 47baed9 [SecurityBundle] Revert adding `_stateless` attribute to the request when firewall is stateless and the attribute is not already set
diff --git a/src/Symfony/Bundle/SecurityBundle/Security/FirewallMap.php b/src/Symfony/Bundle/SecurityBundle/Security/FirewallMap.php
@@ -72,14 +72,7 @@ private function getFirewallContext(Request $request): ?FirewallContext
             if (null === $requestMatcher || $requestMatcher->matches($request)) {
                 $request->attributes->set('_firewall_context', $contextId);
 
-                /** @var FirewallContext $context */
-                $context = $this->container->get($contextId);
-
-                if ($context->getConfig()?->isStateless() && !$request->attributes->has('_stateless')) {
-                    $request->attributes->set('_stateless', true);
-                }
-
-                return $context;
+                return $this->container->get($contextId);
             }
         }
 
diff --git a/src/Symfony/Bundle/SecurityBundle/Tests/Security/FirewallMapTest.php b/src/Symfony/Bundle/SecurityBundle/Tests/Security/FirewallMapTest.php
@@ -63,7 +63,7 @@ public function testGetListeners(Request $request, bool $expectedState)
         $firewallContext = $this->createMock(FirewallContext::class);
 
         $firewallConfig = new FirewallConfig('main', 'user_checker', null, true, true);
-        $firewallContext->expects($this->exactly(2))->method('getConfig')->willReturn($firewallConfig);
+        $firewallContext->expects($this->once())->method('getConfig')->willReturn($firewallConfig);
 
         $listener = function () {};
         $firewallContext->expects($this->once())->method('getListeners')->willReturn([$listener]);
@@ -93,7 +93,7 @@ public function testGetListeners(Request $request, bool $expectedState)
 
     public static function providesStatefulStatelessRequests(): \Generator
     {
-        yield [new Request(), true];
+        yield [new Request(), false];
         yield [new Request(attributes: ['_stateless' => false]), false];
         yield [new Request(attributes: ['_stateless' => true]), true];
     }

Original file line number	Diff line number	Diff line change
`@@ -72,14 +72,7 @@ private function getFirewallContext(Request $request): ?FirewallContext`
`72`	`72`	`if (null === $requestMatcher \|\| $requestMatcher->matches($request)) {`
`73`	`73`	`$request->attributes->set('_firewall_context', $contextId);`
`74`	`74`
`75`		`- /** @var FirewallContext $context */`
`76`		`- $context = $this->container->get($contextId);`
`77`		`-`
`78`		`- if ($context->getConfig()?->isStateless() && !$request->attributes->has('_stateless')) {`
`79`		`- $request->attributes->set('_stateless', true);`
`80`		`- }`
`81`		`-`
`82`		`- return $context;`
	`75`	`+ return $this->container->get($contextId);`
`83`	`76`	`}`
`84`	`77`	`}`
`85`	`78`
Original file line number	Diff line number	Diff line change
`@@ -63,7 +63,7 @@ public function testGetListeners(Request $request, bool $expectedState)`
`63`	`63`	`$firewallContext = $this->createMock(FirewallContext::class);`
`64`	`64`
`65`	`65`	`$firewallConfig = new FirewallConfig('main', 'user_checker', null, true, true);`
`66`		`- $firewallContext->expects($this->exactly(2))->method('getConfig')->willReturn($firewallConfig);`
	`66`	`+ $firewallContext->expects($this->once())->method('getConfig')->willReturn($firewallConfig);`
`67`	`67`
`68`	`68`	`$listener = function () {};`
`69`	`69`	`$firewallContext->expects($this->once())->method('getListeners')->willReturn([$listener]);`
`@@ -93,7 +93,7 @@ public function testGetListeners(Request $request, bool $expectedState)`
`93`	`93`
`94`	`94`	`public static function providesStatefulStatelessRequests(): \Generator`
`95`	`95`	`{`
`96`		`- yield [new Request(), true];`
	`96`	`+ yield [new Request(), false];`
`97`	`97`	`yield [new Request(attributes: ['_stateless' => false]), false];`
`98`	`98`	`yield [new Request(attributes: ['_stateless' => true]), true];`
`99`	`99`	`}`