[Security] Fix logout #24805

MatTheCat · 2017-11-03T09:12:35Z

Q	A
Branch?	2.7
Bug fix?	yes
New feature?	no
BC breaks?	no
Deprecations?	no
Tests pass?	no
Fixed tickets	#6751, #7104
License	MIT

chalasr · 2017-11-03T12:23:23Z

~~👎 because #7104 (comment), sorry~~

chalasr · 2017-11-03T12:45:45Z

src/Symfony/Component/Security/Http/Firewall.php

+
+            $listener->handle($event);
+
+            $hasResponse = $event->hasResponse();


this means that it won't stop at the first listener setting the response anymore, allowing others to set the response

Nope only LogoutListener can override the response if it has been set (see https://github.com/symfony/symfony/pull/24805/files#diff-31ca8a8ce837591218082b00363149fcR65). And handle is called so #7104 (comment) doesn't apply.

Can you add a test case for this? with multiple listeners if possible

I'll try but I don't know how to do it yet

nicolas-grekas · 2017-11-12T15:38:13Z

src/Symfony/Bundle/SecurityBundle/DependencyInjection/SecurityExtension.php

@@ -359,6 +358,11 @@ private function createFirewall(ContainerBuilder $container, $id, $firewall, &$a
        // Access listener
        $listeners[] = new Reference('security.access_listener');

+        // Logout listener
+        if (isset($logoutListener)) {


comment should be removed (low value)
the "isset" shold be replaced by null !== $logoutListener (which implies setting the var to null when appropriate)

MatTheCat · 2017-11-12T16:13:49Z

I guess TraceableFirewallListener will need to be updated when merging in 3.4/4.0

MatTheCat · 2017-11-14T13:16:45Z

Is there something missing for this PR to be merged?

xabbuh · 2017-11-16T21:00:40Z

src/Symfony/Bundle/SecurityBundle/DependencyInjection/SecurityExtension.php

@@ -359,6 +360,10 @@ private function createFirewall(ContainerBuilder $container, $id, $firewall, &$a
        // Access listener
        $listeners[] = new Reference('security.access_listener');

+        if (null !== $logoutListenerId) {


Can't we just move the whole block that starts with if (isset($firewall['logout'])) { here?

Nope because factories rely on the definition being in the container so we must create it before but still register last.

xabbuh · 2017-11-16T21:01:10Z

src/Symfony/Bundle/SecurityBundle/DependencyInjection/SecurityExtension.php

@@ -285,16 +285,20 @@ private function createFirewall(ContainerBuilder $container, $id, $firewall, &$a
            $listeners[] = new Reference($this->createContextListener($container, $contextKey));
        }

+        // Determine default entry point
+        $configuredEntryPoint = isset($firewall['entry_point']) ? $firewall['entry_point'] : null;


should probably be moved back as this is not needed

stof · 2017-11-17T14:17:59Z

src/Symfony/Component/Security/Http/Firewall.php

                break;
+            } elseif ($hasResponse) {


just if as the previous if stops the execution path with break already.

stof · 2017-11-17T14:18:40Z

src/Symfony/Component/Security/Http/Firewall.php

@@ -53,13 +54,21 @@ public function onKernelRequest(GetResponseEvent $event)
            $exceptionListener->register($this->dispatcher);
        }

+        $hasResponse = false;


You don't need to create this variable. Just use $event->hasResponse() in the right place.

stof · 2017-11-17T14:19:38Z

Note that this will defeat the lazy-loading added in 3.4, as the loop will always iterate until it reaches the logout listener, and it is at the end.

MatTheCat · 2017-12-03T14:32:23Z

@chalasr @nicolas-grekas @stof @xabbuh I tried to exclude the logout listener from others to allow lazy-loading. I guess it introduced BC breaks so I would like you to review this.

MatTheCat · 2017-12-03T15:46:40Z

I don't understand why tests fail on PHP > 7.0, seems like a routing issue... Tests pass on my computer with PHP 7.1.12

MatTheCat · 2017-12-15T16:08:16Z

Should I duplicate this PR to get more visibility? The logout listener never did work so I thought this would have got more attention.

chalasr · 2017-12-15T16:49:45Z

@MatTheCat No need for reopening a new one.
Sorry for not giving you more feedback yet, but be sure that this has my attention.
That's an important bug which exists for a long time, if we can fix it, we need to do it right.
I think it's close to be ok, you tried a lot of approaches and that's great. What prevents me to approve is the fact we need to change some public api, hence I want to review it more throughly, check it out and see if we can do that more transparently.
Note that as of 3.3 FirewallContext::getContext() is deprecated in favor of separated getListeners() and getExceptionListener(), which means we would need to add a new public method when merging this up to 3.3, hence I'm not comfortable with this as is. Please be a bit more a patient, I will give more inputs as soon as I have time.
Thanks for your understanding.

MatTheCat · 2017-12-27T09:46:55Z

I rebased one last time. People impacted by this issue will have to disable logout in their configuration and call their handler in the controller of their logout route.

src/Symfony/Bundle/SecurityBundle/Tests/Functional/LogoutTest.php

+
+        $this->assertNull($cookieJar->get('REMEMBERME'));
+    }
+}


chalasr · 2017-12-27T12:53:34Z

Given that this implies public API changes in patch releases, I think that the previous version would be better (passing a fake token to logout handlers if no one exists in the token storage).
@stof @xabbuh what do you think?

chalasr · 2018-05-15T10:16:52Z

Does that mean mean I have to increment symfony/security version?

yea, SecurityBundle's symfony/security requirement should be "~2.7.47|~2.8.40" (#24805 (review))

chalasr · 2018-05-15T10:27:29Z

src/Symfony/Component/Security/Http/FirewallMapInterface.php

@@ -21,16 +21,19 @@
 interface FirewallMapInterface
 {
    /**
-     * Returns the authentication listeners, and the exception listener to use
-     * for the given request.
+     * Returns the authentication listeners, the exception listener and the logout


just chatted a bit with @nicolas-grekas, let's revert the interface changes now (changelog update not needed anymore), we need to change this on 4.1 with proper deprecation.

agreed: should be reverted and reintroduced in 4.1 with a deprecation notice

chalasr

👍

stof · 2018-05-15T13:15:14Z

After merging this (and once it is propagated until master), we should get another PR against master to deprecate the case of returning only 2 elements in the firewall map. This can be checked in the Firewall class.

nicolas-grekas · 2018-05-15T15:40:16Z

Thank you @MatTheCat.

This PR was squashed before being merged into the 2.7 branch (closes #24805). Discussion ---------- [Security] Fix logout | Q | A | ------------- | --- | Branch? | 2.7 | Bug fix? | yes | New feature? | no | BC breaks? | no | Deprecations? | no | Tests pass? | no | Fixed tickets | #6751, #7104 | License | MIT Commits ------- 9e88eb5 [Security] Fix logout

chalasr · 2018-05-15T15:56:01Z

I'll take care of the master PR.

MacDada · 2018-05-15T16:45:48Z

src/Symfony/Component/Security/Http/Firewall.php

            $listener->handle($event);

            if ($event->hasResponse()) {
                break;
            }
        }
+
+        if (null !== $logoutListener) {
+            $logoutListener->handle($event);


MatTheCat · 2018-05-15T17:10:40Z

Yay thanks!

nicolas-grekas · 2018-05-15T21:25:43Z

src/Symfony/Bundle/SecurityBundle/Security/FirewallContext.php


-    public function __construct(array $listeners, ExceptionListener $exceptionListener = null)
+    public function __construct(array $listeners, ExceptionListener $exceptionListener = null, LogoutListener $logoutListener = null)


fun fact: on 3.4 & up, this class already has a 3rd argument: FirewallConfig $config
To prevent any funnier things, I suggest adding this argument in 2.7 (but ignoring its value).
WDYT? Any better idea?

Can we do this on concerned branches only?

we could change for a setter on 2.7, not sure it's better. Here is what you propose #27280

I finally managed to merge, see 86a9c73#diff-cf0390616c24425d612bcf9ee1555111
@chalasr when doing your PR against master, please also deprecate passing a FirewallConfig as 3rd arg there.

… deprecations (chalasr) This PR was merged into the 4.2-dev branch. Discussion ---------- [Security][SecurityBundle] FirewallMap/FirewallContext deprecations | Q | A | ------------- | --- | Branch? | master | Bug fix? | no | New feature? | no | BC breaks? | no | Deprecations? | yes/no  | Tests pass? | yes  | Fixed tickets | #...  | License | MIT | Doc PR | symfony/symfony-docs#...  Next to #24805. Commits ------- a71ba78 [Security][SecurityBundle] FirewallMap/FirewallContext deprecations

carsonbot added Status: Needs Review Security Bug labels Nov 3, 2017

chalasr added this to the 2.7 milestone Nov 3, 2017

chalasr reviewed Nov 3, 2017

View reviewed changes

chalasr requested a review from stof November 3, 2017 13:00

chalasr approved these changes Nov 6, 2017

View reviewed changes

carsonbot added Status: Reviewed and removed Status: Needs Review labels Nov 6, 2017

nicolas-grekas reviewed Nov 12, 2017

View reviewed changes

xabbuh reviewed Nov 16, 2017

View reviewed changes

stof requested changes Nov 17, 2017

View reviewed changes

carsonbot added Status: Needs Work and removed Status: Reviewed labels Nov 17, 2017

chalasr self-requested a review December 12, 2017 01:24

carsonbot added Status: Needs Review and removed Status: Needs Work labels Dec 12, 2017

MatTheCat mentioned this pull request Dec 21, 2017

[Security] Call logout handlers even if token is null #24769

Closed

chalasr reviewed Dec 27, 2017

View reviewed changes

src/Symfony/Bundle/SecurityBundle/Tests/Functional/LogoutTest.php

$this->assertNull($cookieJar->get('REMEMBERME'));

}

}

This comment was marked as resolved.

Sign in to view

chalasr reviewed May 15, 2018

View reviewed changes

chalasr approved these changes May 15, 2018

View reviewed changes

carsonbot added Status: Reviewed and removed Status: Needs Work labels May 15, 2018

stof approved these changes May 15, 2018

View reviewed changes

[Security] Fix logout

9e88eb5

nicolas-grekas merged commit 9e88eb5 into symfony:2.7 May 15, 2018

MacDada reviewed May 15, 2018

View reviewed changes

nicolas-grekas reviewed May 15, 2018

View reviewed changes

MatTheCat deleted the ticket_7104 branch May 15, 2018 21:57

chalasr mentioned this pull request May 16, 2018

[SecurityBundle] Fix FirewallContext constructor 3.4 compatibility #27280

Closed

This was referenced May 21, 2018

Release v2.7.47 #27327

Merged

Release v2.8.40 #27328

Merged

Release v3.4.10 #27329

Merged

Release v4.0.10 #27330

Merged

MatTheCat mentioned this pull request May 21, 2018

Logout handler won't be called when stateless is true. #5245

Closed

fabpot mentioned this pull request May 21, 2018

Release v4.1.0-BETA2 #27331

Merged

chalasr mentioned this pull request May 22, 2018

[Security][SecurityBundle] FirewallMap/FirewallContext deprecations #27336

Merged

nreynis mentioned this pull request May 25, 2018

Logout broken in Symfony 3.4.10 hslavich/OneloginSamlBundle#53

Closed

xelan mentioned this pull request Jul 25, 2018

[BC Break] Change of logout path access control behavior #28058

Closed

leofeyer mentioned this pull request Jan 22, 2019

Cancel the two-factor authentication contao/contao#292

Closed

chalasr mentioned this pull request Jul 21, 2019

[Security] REMEMBERME cookie does not get deleted using the "logout_on_user_change" option #31172

Closed

chalasr mentioned this pull request Jun 19, 2020

[Security] Configurable execution order for firewall listeners #37337

Merged


		$listener->handle($event);

		$hasResponse = $event->hasResponse();


		public function __construct(array $listeners, ExceptionListener $exceptionListener = null)
		public function __construct(array $listeners, ExceptionListener $exceptionListener = null, LogoutListener $logoutListener = null)

[Security] Fix logout #24805

[Security] Fix logout #24805

Conversation

MatTheCat commented Nov 3, 2017 • edited Loading

chalasr commented Nov 3, 2017 • edited Loading

Choose a reason for hiding this comment

MatTheCat Nov 3, 2017 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

MatTheCat commented Nov 12, 2017

MatTheCat commented Nov 14, 2017

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

stof commented Nov 17, 2017

MatTheCat commented Dec 3, 2017

MatTheCat commented Dec 3, 2017 • edited Loading

MatTheCat commented Dec 15, 2017

chalasr commented Dec 15, 2017

MatTheCat commented Dec 27, 2017

This comment was marked as resolved.

chalasr commented Dec 27, 2017 • edited Loading

chalasr commented May 15, 2018

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

chalasr left a comment

Choose a reason for hiding this comment

stof commented May 15, 2018

nicolas-grekas commented May 15, 2018

chalasr commented May 15, 2018

Choose a reason for hiding this comment

MatTheCat commented May 15, 2018

Choose a reason for hiding this comment

MatTheCat May 15, 2018 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

MatTheCat commented Nov 3, 2017 •

edited

Loading

chalasr commented Nov 3, 2017 •

edited

Loading

MatTheCat Nov 3, 2017 •

edited

Loading

MatTheCat commented Dec 3, 2017 •

edited

Loading

chalasr commented Dec 27, 2017 •

edited

Loading

MatTheCat May 15, 2018 •

edited

Loading