[2.3][SECURITY] Add remember me cookie configuration #14491

klaascuvelier · 2015-04-28T07:24:59Z

Q	A
Bug fix?	yes
New feature?	no
BC breaks?	no
Deprecations?	no
Tests pass?	yes
Fixed tickets	#14490
License	MIT
Doc PR

klaascuvelier · 2015-04-28T07:41:57Z

Apparently this build fails on Jenkins, but it appears to be on some unrelated tests.
All tests did succeed locally.

Any ideas how to proceed here?

Koc · 2015-04-28T07:43:37Z

src/Symfony/Component/Security/Http/RememberMe/AbstractRememberMeServices.php

+                1,
+                $this->options['path'],
+                $this->options['domain'],
+                isset($this->options['secure']) ? $this->options['secure'] : false,


What about using array_merge in constructor to be sure that this options always exists?

But what is the advantage of that?

If an array_merge should be added, it would not have to be here, but at the point of reading the the config file imo

Big advantage for me: I see full default configuration in the constructor. So no need scroll down to line no 296 for getting default value of secure parameter. Also I see full list of options that available in this class.

It is common practice

symfony/src/Symfony/Bundle/FrameworkBundle/Translation/Translator.php

Line 66 in 6393ec3

$this->options = array_merge($this->options, $options);

symfony/src/Symfony/Component/Security/Http/Authentication/DefaultAuthenticationFailureHandler.php

Line 75 in 2aeaa22

public function setOptions(array $options)

symfony/src/Symfony/Component/HttpFoundation/Session/Storage/Handler/MongoDbSessionHandler.php

Line 82 in aad7963

$this->options = array_merge(array(

Okay, I see your point @Koc.
Updated the PR!

klaascuvelier · 2015-09-22T13:42:44Z

So all checks passed this time, not sure what the next steps are.
cc @fabpot

sstok · 2015-09-22T17:55:43Z

Can you add some tests to prevent future breakage?
See #14843 for an example.

Status: needs work

klaascuvelier · 2015-09-22T17:59:30Z

@sstok I'll look in to it.
When I did this, should I remove the needs work label myself, so somebody takes another look at it?

klaascuvelier · 2015-09-23T14:03:02Z

@sstok test has been added.

sstok · 2015-09-24T09:23:42Z

Apply the Fabbot patch and this should be good http://fabbot.io/report/symfony/symfony/14491/78eb0fd7b5cd9554943c610e315441715c3b629f#patchcs

klaascuvelier · 2015-09-24T09:27:25Z

@sstok yeah sorry about the standards, it's applied, redoing tests.

klaascuvelier · 2015-09-24T09:29:29Z

What will be the necessary steps to get this on the newer versions of Symfony? (2.7, 2.8)

klaascuvelier · 2015-09-24T10:43:13Z

Any idea why this happened? https://ci.appveyor.com/project/fabpot/symfony/build/1.0.1172/job/itg8ut8oqr82912s

sstok · 2015-09-24T10:45:28Z

The 2.3 branch is merged into the 2.7 and eventually 2.8 and master on a weekly basis.
Appveyor failure is unrelated.

Status: Reviewed

klaascuvelier · 2015-09-30T07:00:19Z

@sstok can you fill me in on what the next steps are? Do I just wait until it gets merged in, or do I have to do something else myself?

klaascuvelier · 2015-10-06T06:58:07Z

So apparently this one got merged instead: #14842

Kind of weird my solution was overlooked @sstok @fabpot .

xabbuh · 2015-10-06T07:57:48Z

@klaascuvelier I am sorry that your pull request has been overlooked. However, your solution has the advantage that it does not fail when one of the new options is omitted. Would you mind rebasing your PR on the latest 2.3 branch to modify the existing behaviour such that these options will be ignored when not passed?

klaascuvelier · 2015-10-06T10:03:03Z

@xabbuh it appears my tests are failing due to the merge of #16139
I see in that ticket a remark like "oops I merged this too soon". How is this possible?

xabbuh · 2015-10-06T12:50:54Z

@klaascuvelier Imho you ignore those failures for the moment and just rebase your changes on the latest commit of the 2.3 branch.

klaascuvelier · 2015-10-06T12:53:41Z

@xabbuh, I actually did that, if I do git fetch upstream && git merge upstream/2.3 again it tells me Already up-to-date. so doing another rebase seems pointless to me, no?

I might wait for this one to get merged and do another rebase? #16141

fabpot · 2015-10-06T12:59:26Z

#16141 has been merged now.

xabbuh · 2015-10-06T13:02:24Z

@klaascuvelier Well, it looks a bit strange that your PR contains the commit made by @nicolas-grekas. However, the diff looks right. Could you please also revert the changes to the test classes made in #14842 where the default values are set for the options?

fabpot · 2015-10-06T13:03:24Z

That's because you did a merge, not a rebase. We need a rebase to keep the history clean.

klaascuvelier · 2015-10-06T13:04:30Z

I did a rebase from 2.3, like described here: http://symfony.com/doc/current/contributing/code/patches.html#step-3-submit-your-patch
but with 2.3 instead of master

klaascuvelier · 2015-10-06T13:06:37Z

Can you tell me what exactly you want me to do, to fix this mess-up?

fabpot · 2015-10-06T13:07:12Z

This should work:

git fetch upstream
git rebase upstream/2.3

From your branch.

klaascuvelier · 2015-10-06T13:23:58Z

Okay, I did a new rebase, PR looks better now.
The reason the other commit came in was probably because I did a git push origin SECURE_COOKIE, with --force, it failed, I git pulled and repushed. I noticed now the info on the contributing page explicitly states to use --force, which I did now.

xabbuh · 2015-10-06T13:24:17Z

This looks better. Could you also modify the test classes as described in #14491 (comment)?

fabpot · 2015-10-06T13:25:27Z

src/Symfony/Component/Security/Http/RememberMe/AbstractRememberMeServices.php

+                $this->options['secure'],
+                $this->options['httponly']
+            )
+        );


should be kept on one line

klaascuvelier · 2015-10-06T13:28:59Z

Alright, fixed both of your remarks as well.

xabbuh · 2015-10-06T13:39:22Z

They should be revert in PersistentTokenBasedRememberMeServicesTest and TokenBasedRememberMeServicesTest too.

klaascuvelier · 2015-10-06T14:24:14Z

Anything I can do about the failing tests?

fabpot · 2015-10-06T14:27:52Z

Nope, they're going to be fixed by other PRs.

fabpot · 2015-10-06T14:29:04Z

Thank you @klaascuvelier.

…aascuvelier) This PR was squashed before being merged into the 2.3 branch (closes #14491). Discussion ---------- [2.3][SECURITY] Add remember me cookie configuration | Q | A | ------------- | --- | Bug fix? | yes | New feature? | no | BC breaks? | no | Deprecations? | no | Tests pass? | yes | Fixed tickets | #14490 | License | MIT | Doc PR | Commits ------- e8f0e5a [2.3][SECURITY] Add remember me cookie configuration

klaascuvelier changed the title ~~Add remember me cookie configuration~~ [2.3][SECURITY] Add remember me cookie configuration Apr 28, 2015

Koc reviewed Apr 28, 2015
View reviewed changes

xabbuh added the Security label May 1, 2015

carsonbot added the Status: Needs Work label Sep 22, 2015

carsonbot added Status: Reviewed and removed Status: Needs Work labels Sep 24, 2015

klaascuvelier added 2 commits October 6, 2015 15:09

Add remember me cookie configuration

0e07df2

Update comment

a91ba38

klaascuvelier added 7 commits October 6, 2015 15:11

Add test

d1247b6

Use array_merge to set default options

73d7fd9

Fix coding standards + remove comment

038b320

Add remember me cookie configuration

be14083

Update comment

66d5a77

Add test

378313a

Use array_merge to set default options

629f129

Apply code standard patch

7a7faad

fabpot reviewed Oct 6, 2015
View reviewed changes

klaascuvelier added 2 commits October 6, 2015 15:26

Remove default values

8ce2fff

Revert to 1 line

017d128

Revert default values, as remember-me service has them

5d3d435

fabpot closed this Oct 6, 2015

Uh oh!

[2.3][SECURITY] Add remember me cookie configuration #14491

[2.3][SECURITY] Add remember me cookie configuration #14491

Uh oh!

Conversation

klaascuvelier commented Apr 28, 2015

Uh oh!

klaascuvelier commented Apr 28, 2015

Uh oh!

Koc Apr 28, 2015

Choose a reason for hiding this comment

Uh oh!

klaascuvelier Apr 28, 2015

Choose a reason for hiding this comment

Uh oh!

Koc Sep 23, 2015

Choose a reason for hiding this comment

Uh oh!

Koc Sep 23, 2015

Choose a reason for hiding this comment

Uh oh!

klaascuvelier Sep 24, 2015

Choose a reason for hiding this comment

Uh oh!

klaascuvelier commented Sep 22, 2015

Uh oh!

sstok commented Sep 22, 2015

Uh oh!

klaascuvelier commented Sep 22, 2015

Uh oh!

klaascuvelier commented Sep 23, 2015

Uh oh!

sstok commented Sep 24, 2015

Uh oh!

klaascuvelier commented Sep 24, 2015

Uh oh!

klaascuvelier commented Sep 24, 2015

Uh oh!

klaascuvelier commented Sep 24, 2015

Uh oh!

sstok commented Sep 24, 2015

Uh oh!

klaascuvelier commented Sep 30, 2015

Uh oh!

klaascuvelier commented Oct 6, 2015

Uh oh!

xabbuh commented Oct 6, 2015

Uh oh!

klaascuvelier commented Oct 6, 2015

Uh oh!

xabbuh commented Oct 6, 2015

Uh oh!

klaascuvelier commented Oct 6, 2015

Uh oh!

fabpot commented Oct 6, 2015

Uh oh!

xabbuh commented Oct 6, 2015

Uh oh!

fabpot commented Oct 6, 2015

Uh oh!

klaascuvelier commented Oct 6, 2015

Uh oh!

klaascuvelier commented Oct 6, 2015

Uh oh!

fabpot commented Oct 6, 2015

Uh oh!

klaascuvelier commented Oct 6, 2015

Uh oh!

xabbuh commented Oct 6, 2015

Uh oh!

fabpot Oct 6, 2015

Choose a reason for hiding this comment

Uh oh!

klaascuvelier commented Oct 6, 2015

Uh oh!

xabbuh commented Oct 6, 2015

Uh oh!

klaascuvelier commented Oct 6, 2015

Uh oh!

fabpot commented Oct 6, 2015