diff --git a/UPGRADE-7.2.md b/UPGRADE-7.2.md
index 5962371dc41cb..d3cbd8f88489a 100644
--- a/UPGRADE-7.2.md
+++ b/UPGRADE-7.2.md
@@ -39,6 +39,8 @@ Security
* Add `$token` argument to `UserCheckerInterface::checkPostAuth()`
* Deprecate argument `$secret` of `RememberMeToken` and `RememberMeAuthenticator`
+ * Deprecate passing an empty string as `$userIdentifier` argument to `UserBadge` constructor
+ * Deprecate returning an empty string in `UserInterface::getUserIdentifier()`
String
------
diff --git a/src/Symfony/Component/Security/Core/CHANGELOG.md b/src/Symfony/Component/Security/Core/CHANGELOG.md
index ac99a3c0b243f..5dd5ef38952b4 100644
--- a/src/Symfony/Component/Security/Core/CHANGELOG.md
+++ b/src/Symfony/Component/Security/Core/CHANGELOG.md
@@ -6,6 +6,7 @@ CHANGELOG
* Add `$token` argument to `UserCheckerInterface::checkPostAuth()`
* Deprecate argument `$secret` of `RememberMeToken`
+ * Deprecate returning an empty string in `UserInterface::getUserIdentifier()`
7.0
---
diff --git a/src/Symfony/Component/Security/Core/User/UserInterface.php b/src/Symfony/Component/Security/Core/User/UserInterface.php
index 50f8fb0f005d2..e6078399d685b 100644
--- a/src/Symfony/Component/Security/Core/User/UserInterface.php
+++ b/src/Symfony/Component/Security/Core/User/UserInterface.php
@@ -56,6 +56,8 @@ public function eraseCredentials(): void;
/**
* Returns the identifier for this user (e.g. username or email address).
+ *
+ * @return non-empty-string
*/
public function getUserIdentifier(): string;
}
diff --git a/src/Symfony/Component/Security/Http/Authenticator/Passport/Badge/UserBadge.php b/src/Symfony/Component/Security/Http/Authenticator/Passport/Badge/UserBadge.php
index 1e21628c2a5f8..6833f081d7b72 100644
--- a/src/Symfony/Component/Security/Http/Authenticator/Passport/Badge/UserBadge.php
+++ b/src/Symfony/Component/Security/Http/Authenticator/Passport/Badge/UserBadge.php
@@ -52,6 +52,11 @@ public function __construct(
?callable $userLoader = null,
private ?array $attributes = null,
) {
+ if ('' === $userIdentifier) {
+ trigger_deprecation('symfony/security-http', '7.2', 'Using an empty string as user identifier is deprecated and will throw an exception in Symfony 8.0.');
+ // throw new BadCredentialsException('Empty user identifier.');
+ }
+
if (\strlen($userIdentifier) > self::MAX_USERNAME_LENGTH) {
throw new BadCredentialsException('Username too long.');
}
diff --git a/src/Symfony/Component/Security/Http/CHANGELOG.md b/src/Symfony/Component/Security/Http/CHANGELOG.md
index 487deb4674f05..7945fa22964c7 100644
--- a/src/Symfony/Component/Security/Http/CHANGELOG.md
+++ b/src/Symfony/Component/Security/Http/CHANGELOG.md
@@ -6,6 +6,7 @@ CHANGELOG
* Pass the current token to the `checkPostAuth()` method of user checkers
* Deprecate argument `$secret` of `RememberMeAuthenticator`
+ * Deprecate passing an empty string as `$userIdentifier` argument to `UserBadge` constructor
7.1
---
diff --git a/src/Symfony/Component/Security/Http/Tests/Authenticator/Passport/Badge/UserBadgeTest.php b/src/Symfony/Component/Security/Http/Tests/Authenticator/Passport/Badge/UserBadgeTest.php
index cc79cc1fb9c1a..8a4698923adf8 100644
--- a/src/Symfony/Component/Security/Http/Tests/Authenticator/Passport/Badge/UserBadgeTest.php
+++ b/src/Symfony/Component/Security/Http/Tests/Authenticator/Passport/Badge/UserBadgeTest.php
@@ -12,15 +12,29 @@
namespace Symfony\Component\Security\Http\Tests\Authenticator\Passport\Badge;
use PHPUnit\Framework\TestCase;
+use Symfony\Bridge\PhpUnit\ExpectUserDeprecationMessageTrait;
+use Symfony\Component\Security\Core\Exception\BadCredentialsException;
use Symfony\Component\Security\Core\Exception\UserNotFoundException;
use Symfony\Component\Security\Http\Authenticator\Passport\Badge\UserBadge;
class UserBadgeTest extends TestCase
{
+ use ExpectUserDeprecationMessageTrait;
+
public function testUserNotFound()
{
$badge = new UserBadge('dummy', fn () => null);
$this->expectException(UserNotFoundException::class);
$badge->getUser();
}
+
+ /**
+ * @group legacy
+ */
+ public function testEmptyUserIdentifier()
+ {
+ $this->expectUserDeprecationMessage('Since symfony/security-http 7.2: Using an empty string as user identifier is deprecated and will throw an exception in Symfony 8.0.');
+ // $this->expectException(BadCredentialsException::class)
+ new UserBadge('', fn () => null);
+ }
}
pFad - Phonifier reborn
Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.
Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.
Alternative Proxies:
Alternative Proxy
pFad Proxy
pFad v3 Proxy
pFad v4 Proxy