diff --git a/DependencyInjection/Security/Factory/RememberMeFactory.php b/DependencyInjection/Security/Factory/RememberMeFactory.php
index de19f488..525726b0 100644
--- a/DependencyInjection/Security/Factory/RememberMeFactory.php
+++ b/DependencyInjection/Security/Factory/RememberMeFactory.php
@@ -208,6 +208,7 @@ public function addConfiguration(NodeDefinition $node)
->requiresAtLeastOneElement()
->info('An array of properties on your User that are used to sign the remember-me cookie. If any of these change, all existing cookies will become invalid.')
->example(['email', 'password'])
+ ->defaultValue(['password'])
->end()
->arrayNode('token_provider')
->beforeNormalization()
diff --git a/Tests/Functional/Bundle/RememberMeBundle/Security/UserChangingUserProvider.php b/Tests/Functional/Bundle/RememberMeBundle/Security/UserChangingUserProvider.php
index a5306b6b..f2eebacf 100644
--- a/Tests/Functional/Bundle/RememberMeBundle/Security/UserChangingUserProvider.php
+++ b/Tests/Functional/Bundle/RememberMeBundle/Security/UserChangingUserProvider.php
@@ -21,6 +21,8 @@ class UserChangingUserProvider implements UserProviderInterface
{
private $inner;
+ public static $changePassword = false;
+
public function __construct(InMemoryUserProvider $inner)
{
$this->inner = $inner;
@@ -28,26 +30,31 @@ public function __construct(InMemoryUserProvider $inner)
public function loadUserByUsername($username)
{
- return $this->inner->loadUserByUsername($username);
+ return $this->changeUser($this->inner->loadUserByUsername($username));
}
public function loadUserByIdentifier(string $userIdentifier): UserInterface
{
- return $this->inner->loadUserByIdentifier($userIdentifier);
+ return $this->changeUser($this->inner->loadUserByIdentifier($userIdentifier));
}
public function refreshUser(UserInterface $user)
{
- $user = $this->inner->refreshUser($user);
-
- $alterUser = \Closure::bind(function (InMemoryUser $user) { $user->password = 'foo'; }, null, class_exists(User::class) ? User::class : InMemoryUser::class);
- $alterUser($user);
-
- return $user;
+ return $this->changeUser($this->inner->refreshUser($user));
}
public function supportsClass($class)
{
return $this->inner->supportsClass($class);
}
+
+ private function changeUser(UserInterface $user): UserInterface
+ {
+ if (self::$changePassword) {
+ $alterUser = \Closure::bind(function (InMemoryUser $user) { $user->password = 'changed!'; }, null, class_exists(User::class) ? User::class : InMemoryUser::class);
+ $alterUser($user);
+ }
+
+ return $user;
+ }
}
diff --git a/Tests/Functional/RememberMeTest.php b/Tests/Functional/RememberMeTest.php
index 7af43e11..c1958c7d 100644
--- a/Tests/Functional/RememberMeTest.php
+++ b/Tests/Functional/RememberMeTest.php
@@ -11,8 +11,15 @@
namespace Symfony\Bundle\SecurityBundle\Tests\Functional;
+use Symfony\Bundle\SecurityBundle\Tests\Functional\Bundle\RememberMeBundle\Security\UserChangingUserProvider;
+
class RememberMeTest extends AbstractWebTestCase
{
+ protected function setUp(): void
+ {
+ UserChangingUserProvider::$changePassword = false;
+ }
+
/**
* @dataProvider provideConfigs
*/
@@ -51,11 +58,19 @@ public function testUserChangeClearsCookie()
$this->assertSame(302, $client->getResponse()->getStatusCode());
$cookieJar = $client->getCookieJar();
- $this->assertNotNull($cookieJar->get('REMEMBERME'));
+ $this->assertNotNull($cookie = $cookieJar->get('REMEMBERME'));
+
+ UserChangingUserProvider::$changePassword = true;
+ // change password (through user provider), this deauthenticates the session
$client->request('GET', '/profile');
$this->assertRedirect($client->getResponse(), '/login');
$this->assertNull($cookieJar->get('REMEMBERME'));
+
+ // restore the old remember me cookie, it should no longer be valid
+ $cookieJar->set($cookie);
+ $client->request('GET', '/profile');
+ $this->assertRedirect($client->getResponse(), '/login');
}
public function testSessionLessRememberMeLogout()
@@ -121,11 +136,19 @@ public function testLegacyUserChangeClearsCookie()
$this->assertSame(302, $client->getResponse()->getStatusCode());
$cookieJar = $client->getCookieJar();
- $this->assertNotNull($cookieJar->get('REMEMBERME'));
+ $this->assertNotNull($cookie = $cookieJar->get('REMEMBERME'));
+
+ UserChangingUserProvider::$changePassword = true;
+ // change password (through user provider), this deauthenticates the session
$client->request('GET', '/profile');
$this->assertRedirect($client->getResponse(), '/login');
$this->assertNull($cookieJar->get('REMEMBERME'));
+
+ // restore the old remember me cookie, it should no longer be valid
+ $cookieJar->set($cookie);
+ $client->request('GET', '/profile');
+ $this->assertRedirect($client->getResponse(), '/login');
}
/**
pFad - Phonifier reborn
Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.
Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.
Alternative Proxies:
Alternative Proxy
pFad Proxy
pFad v3 Proxy
pFad v4 Proxy