-
-
Notifications
You must be signed in to change notification settings - Fork 9.6k
[DX] [Security] Renamed Token#getKey() to getSecret() #15141
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Closed
Closed
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
you need to bump the min requirement of |
Thanks @stof, done :) |
👍 |
Thank you @wouterj. |
fabpot
added a commit
that referenced
this pull request
Jul 1, 2015
…(WouterJ) This PR was squashed before being merged into the 2.8 branch (closes #15141). Discussion ---------- [DX] [Security] Renamed Token#getKey() to getSecret() There are 2 very vague parameter names in the authentication process: `$providerKey` and `$key`. Some tokens/providers have the first one, some tokens/providers the second one and some both. An overview: | Token | `providerKey` | `key` | --- | --- | --- | `AnonymousToken` | - | yes | `PreAuth...Token` | yes | - | `RememberMeToken` | yes | yes | `UsernamePasswordToken` | yes | - Both names are extremely general and their PHPdocs contains pure no-shit-sherlock-descriptions :squirrel: (like "The key."). This made me and @iltar think it's just an inconsistency and they have the same meaning. ...until we dived deeper into the code and came to the conclusion that `$key` has a Security task (while `$providerKey` doesn't really). If it takes people connected to Symfony internals 30+ minutes to find this out, it should be considered for an improvement imo. So here is our suggestion: **Rename `$key` to `$secret`**. This explains much better what the value of the string has to be (for instance, it's important that the string is not easily guessable and cannot be found out, according to the Spring docs). It also explains the usage better (it's used as a replacement for credentials and to hash the RememberMeToken). **Tl;dr**: `$key` and `$providerKey` are too general names, let's improve DX by renaming them. This PR tackles `$key` by renaming it to `$secret`. | Q | A | ------------- | --- | Bug fix? | yes | New feature? | no | BC breaks? | no | Deprecations? | yes | Tests pass? | yes | Fixed tickets | - | License | MIT | Doc PR | - *My excuse for the completely unrelated branch name* Commits ------- 24e0eb6 [DX] [Security] Renamed Token#getKey() to getSecret()
xabbuh
added a commit
to symfony/symfony-docs
that referenced
this pull request
Oct 8, 2015
This PR was merged into the 2.8 branch. Discussion ---------- [DX] [Security] Renamed key to secret | Q | A | ------------- | --- | Doc fix? | no | New docs? | yes symfony/symfony#15141 | Applies to | 2.8+ | Fixed tickets | n/a Commits ------- 18c7f04 Remember me, Renamed key to secret
fabpot
added a commit
that referenced
this pull request
Oct 11, 2015
…_me (stof) This PR was merged into the 2.8 branch. Discussion ---------- Fix the BC layer for the key->secret renaming for remember_me | Q | A | ------------- | --- | Bug fix? | yes | New feature? | no | BC breaks? | no | Deprecations? | no | Tests pass? | yes | Fixed tickets | symfony/symfony-docs#5765 | License | MIT | Doc PR | n/a There was a mistake in #15141 removing the configuration entirely. Commits ------- f52b3a0 Fix the BC layer for the key->secret renaming for remember_me
fabpot
added a commit
to symfony/security-bundle
that referenced
this pull request
Oct 11, 2015
…_me (stof) This PR was merged into the 2.8 branch. Discussion ---------- Fix the BC layer for the key->secret renaming for remember_me | Q | A | ------------- | --- | Bug fix? | yes | New feature? | no | BC breaks? | no | Deprecations? | no | Tests pass? | yes | Fixed tickets | symfony/symfony-docs#5765 | License | MIT | Doc PR | n/a There was a mistake in symfony/symfony#15141 removing the configuration entirely. Commits ------- f52b3a0 Fix the BC layer for the key->secret renaming for remember_me
fabpot
added a commit
that referenced
this pull request
Nov 9, 2015
This PR was merged into the 2.8 branch. Discussion ---------- [Security] Renamed key to secret Part 2 Anonymous and RememberMe were already changed in #15141 This PR renames 2 more occurences of key in the Security: AnonymousAuthenticationListener and the Digest entry point. | Q | A | ------------- | --- | Bug fix? | yes | New feature? | no | BC breaks? | no | Deprecations? | yes | Tests pass? | yes | Fixed tickets | - | License | MIT | Doc PR | - Commits ------- 55f59d5 Renamed key to secret
Merged
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There are 2 very vague parameter names in the authentication process:
$providerKey
and$key
. Some tokens/providers have the first one, some tokens/providers the second one and some both. An overview:providerKey
key
AnonymousToken
PreAuth...Token
RememberMeToken
UsernamePasswordToken
Both names are extremely general and their PHPdocs contains pure no-shit-sherlock-descriptions :squirrel: (like "The key."). This made me and @iltar think it's just an inconsistency and they have the same meaning.
...until we dived deeper into the code and came to the conclusion that
$key
has a Security task (while$providerKey
doesn't really). If it takes people connected to Symfony internals 30+ minutes to find this out, it should be considered for an improvement imo.So here is our suggestion: Rename
$key
to$secret
. This explains much better what the value of the string has to be (for instance, it's important that the string is not easily guessable and cannot be found out, according to the Spring docs). It also explains the usage better (it's used as a replacement for credentials and to hash the RememberMeToken).Tl;dr:
$key
and$providerKey
are too general names, let's improve DX by renaming them. This PR tackles$key
by renaming it to$secret
.My excuse for the completely unrelated branch name