-
-
Notifications
You must be signed in to change notification settings - Fork 9.6k
[Security] Prevent creating session in stateless firewalls #51350
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
Hey! Thanks for your PR. You are targeting branch "6.4" but it seems your PR description refers to branch "6.3". Cheers! Carsonbot |
9050ba9
to
ac88a64
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Please add test cases with _stateless => true
for both success and failure handlers to prevent regressions
@chalasr tests added |
@wouterj @chalasr Could you have a second look at this? I can confirm the fix on HWIOAuthBundle. Before:
After:
|
...ony/Component/Security/Http/Tests/Authentication/DefaultAuthenticationFailureHandlerTest.php
Show resolved
Hide resolved
@fabpot / @nicolas-grekas or anyone else can check this fix? I would love to have it in near 6.3 release |
Thank you @Seb33300. |
Please check related issue for details.
Same as #51320 with @chalasr suggestion: #51320 (comment)