Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 865127b

Browse files
fabpotfabpot
committed
feature #30111 [SecurityBundle] Deprecate the normalization of the cookie names (javiereguiluz)
This PR was squashed before being merged into the 4.3-dev branch (closes #30111). Discussion ---------- [SecurityBundle] Deprecate the normalization of the cookie names | Q | A | ------------- | --- | Branch? | master | Bug fix? | yes | New feature? | yes | BC breaks? | no | Deprecations? | no | Tests pass? | yes | Fixed tickets | - | License | MIT | Doc PR | - This is an alternative solution to #24018 providing a BC layer until Symfony 5.0. Commits ------- 36c5df4 [SecurityBundle] Deprecate the normalization of the cookie names
2 parents 33145da + 36c5df4 commit 865127b

File tree

7 files changed

+107
-5
lines changed

7 files changed

+107
-5
lines changed

‎UPGRADE-5.0.md

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -192,7 +192,7 @@ HttpKernel
192192
* The `Kernel::getRootDir()` and the `kernel.root_dir` parameter have been removed
193193
* The `KernelInterface::getName()` and the `kernel.name` parameter have been removed
194194
* Removed the first and second constructor argument of `ConfigDataCollector`
195-
* Removed `ConfigDataCollector::getApplicationName()`
195+
* Removed `ConfigDataCollector::getApplicationName()`
196196
* Removed `ConfigDataCollector::getApplicationVersion()`
197197

198198
Monolog
@@ -278,6 +278,11 @@ SecurityBundle
278278
use Guard instead.
279279
* The `SimpleFormFactory` and `SimplePreAuthenticationFactory` classes have been removed,
280280
use Guard instead.
281+
* The names of the cookies configured in the `logout.delete_cookies` option are
282+
no longer normalized. If any of your cookie names has dashes they won't be
283+
changed to underscores.
284+
Before: `my-cookie` deleted the `my_cookie` cookie (with an underscore).
285+
After: `my-cookie` deletes the `my-cookie` cookie (with a dash).
281286

282287
Serializer
283288
----------
@@ -326,5 +331,5 @@ Workflow
326331
Yaml
327332
----
328333

329-
* The parser is now stricter and will throw a `ParseException` when a
334+
* The parser is now stricter and will throw a `ParseException` when a
330335
mapping is found inside a multi-line string.

‎src/Symfony/Bundle/SecurityBundle/CHANGELOG.md

Lines changed: 11 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,18 @@
11
CHANGELOG
22
=========
33

4+
4.3.0
5+
-----
6+
7+
* The normalization of the cookie names configured in the `logout.delete_cookies`
8+
option is deprecated and will be disabled in Symfony 5.0. This affects to cookies
9+
with dashes in their names. For example, starting from Symfony 5.0, the `my-cookie`
10+
name will delete `my-cookie` (with a dash) instead of `my_cookie` (with an underscore).
11+
412
4.2.0
513
-----
614

7-
* Using the `security.authentication.trust_resolver.anonymous_class` and
15+
* Using the `security.authentication.trust_resolver.anonymous_class` and
816
`security.authentication.trust_resolver.rememberme_class` parameters to define
917
the token classes is deprecated. To use custom tokens extend the existing
1018
`Symfony\Component\Security\Core\Authentication\Token\AnonymousToken`.
@@ -17,7 +25,7 @@ CHANGELOG
1725
* Deprecated the `SimpleFormFactory` and `SimplePreAuthenticationFactory` classes, use Guard instead.
1826
* Added `port` in access_control
1927
* Added individual voter decisions to the profiler
20-
28+
2129
4.1.0
2230
-----
2331

@@ -50,7 +58,7 @@ CHANGELOG
5058
* Tagging voters with the `security.voter` tag without implementing the
5159
`VoterInterface` on the class is now deprecated and will be removed in 4.0.
5260
* [BC BREAK] `FirewallContext::getListeners()` now returns `\Traversable|array`
53-
* added info about called security listeners in profiler
61+
* added info about called security listeners in profiler
5462
* Added `logout_on_user_change` to the firewall options. This config item will
5563
trigger a logout when the user has changed. Should be set to true to avoid
5664
deprecations in the configuration.

‎src/Symfony/Bundle/SecurityBundle/DependencyInjection/MainConfiguration.php

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -218,10 +218,27 @@ private function addFirewallsSection(ArrayNodeDefinition $rootNode, array $facto
218218
->fixXmlConfig('delete_cookie')
219219
->children()
220220
->arrayNode('delete_cookies')
221+
->normalizeKeys(false)
221222
->beforeNormalization()
222223
->ifTrue(function ($v) { return \is_array($v) && \is_int(key($v)); })
223224
->then(function ($v) { return array_map(function ($v) { return ['name' => $v]; }, $v); })
224225
->end()
226+
->beforeNormalization()
227+
->ifArray()->then(function ($v) {
228+
foreach ($v as $originalName => $cookieConfig) {
229+
if (false !== strpos($originalName, '-')) {
230+
$normalizedName = str_replace('-', '_', $originalName);
231+
@trigger_error(sprintf('Normalization of cookie names is deprecated since Symfony 4.3. Starting from Symfony 5.0, the "%s" cookie configured in "logout.delete_cookies" will delete the "%s" cookie instead of the "%s" cookie.', $originalName, $originalName, $normalizedName), E_USER_DEPRECATED);
232+
233+
// normalize cookie names manually for BC reasons. Remove it in Symfony 5.0.
234+
$v[$normalizedName] = $cookieConfig;
235+
unset($v[$originalName]);
236+
}
237+
}
238+
239+
return $v;
240+
})
241+
->end()
225242
->useAttributeAsKey('name')
226243
->prototype('array')
227244
->children()

‎src/Symfony/Bundle/SecurityBundle/Tests/DependencyInjection/CompleteConfigurationTest.php

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -506,6 +506,20 @@ public function testSimpleAuth()
506506
]], $listeners);
507507
}
508508

509+
/**
510+
* @group legacy
511+
* @expectedDeprecation Normalization of cookie names is deprecated since Symfony 4.3. Starting from Symfony 5.0, the "cookie1-name" cookie configured in "logout.delete_cookies" will delete the "cookie1-name" cookie instead of the "cookie1_name" cookie.
512+
* @expectedDeprecation Normalization of cookie names is deprecated since Symfony 4.3. Starting from Symfony 5.0, the "cookie3-long_name" cookie configured in "logout.delete_cookies" will delete the "cookie3-long_name" cookie instead of the "cookie3_long_name" cookie.
513+
*/
514+
public function testLogoutDeleteCookieNamesNormalization()
515+
{
516+
$container = $this->getContainer('logout_delete_cookies');
517+
$cookiesToDelete = $container->getDefinition('security.logout.handler.cookie_clearing.main')->getArgument(0);
518+
$expectedCookieNames = ['cookie2_name', 'cookie1_name', 'cookie3_long_name'];
519+
520+
$this->assertSame($expectedCookieNames, array_keys($cookiesToDelete));
521+
}
522+
509523
protected function getContainer($file)
510524
{
511525
$file .= '.'.$this->getFileExtension();

‎src/Symfony/Bundle/SecurityBundle/Tests/DependencyInjection/Fixtures/php/logout_delete_cookies.php

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
<?php
2+
3+
$container->loadFromExtension('security', [
4+
'providers' => [
5+
'default' => ['id' => 'foo'],
6+
],
7+
8+
'firewalls' => [
9+
'main' => [
10+
'provider' => 'default',
11+
'form_login' => true,
12+
'logout' => [
13+
'delete_cookies' => [
14+
'cookie1-name' => true,
15+
'cookie2_name' => true,
16+
'cookie3-long_name' => ['path' => '/'],
17+
],
18+
],
19+
],
20+
],
21+
]);

‎src/Symfony/Bundle/SecurityBundle/Tests/DependencyInjection/Fixtures/xml/logout_delete_cookies.xml

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
3+
<srv:container xmlns="http://symfony.com/schema/dic/security"
4+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
5+
xmlns:srv="http://symfony.com/schema/dic/services"
6+
xsi:schemaLocation="http://symfony.com/schema/dic/services http://symfony.com/schema/dic/services/services-1.0.xsd">
7+
8+
<config>
9+
<provider name="default" id="foo" />
10+
11+
<firewall name="main" provider="default">
12+
<form-login />
13+
<logout>
14+
<delete-cookies>
15+
<cookie1-name/>
16+
<cookie2_name/>
17+
<cookie3-long_name path="/" />
18+
</delete-cookies>
19+
</logout>
20+
</firewall>
21+
</config>
22+
</srv:container>

‎src/Symfony/Bundle/SecurityBundle/Tests/DependencyInjection/Fixtures/yml/logout_delete_cookies.yml

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
security:
2+
providers:
3+
default:
4+
id: foo
5+
6+
firewalls:
7+
main:
8+
provider: default
9+
form_login: true
10+
logout:
11+
delete_cookies:
12+
cookie1-name: ~
13+
cookie2_name: ~
14+
cookie3-long_name:
15+
path: '/'

0 commit comments

Comments
 (0)