[Security][Ldap] Remove deprecated eraseCredentials() from (User|Token)Interface

chalasr · nicolas-grekas · commit 513a272d19e1 · 2025-06-16T08:44:26.000+02:00
diff --git a/UPGRADE-8.0.md b/UPGRADE-8.0.md
@@ -87,6 +87,11 @@ HttpClient
  * Remove support for amphp/http-client < 5
  * Remove setLogger() methods on decorators; configure the logger on the wrapped client directly instead
 
+Ldap
+----
+
+ * Remove `LdapUser::eraseCredentials()` in favor of `__serialize()`
+
 OptionsResolver
 ---------------
 
@@ -207,6 +212,26 @@ PropertyInfo
    }
    ```
 
+Security
+--------
+
+ * Remove `UserInterface::eraseCredentials()` and `TokenInterface::eraseCredentials()`;
+   erase credentials e.g. using `__serialize()` instead:
+
+  ```diff
+  -public function eraseCredentials(): void
+  -{
+  -}
+  +// If your eraseCredentials() method was used to empty a "password" property:
+  +public function __serialize(): array
+  +{
+  +    $data = (array) $this;
+  +    unset($data["\0".self::class."\0password"]);
+  +
+  +    return $data;
+  +}
+  ```
+
 TwigBridge
 ----------
 
diff --git a/src/Symfony/Bridge/Doctrine/Tests/Fixtures/User.php b/src/Symfony/Bridge/Doctrine/Tests/Fixtures/User.php
@@ -45,11 +45,6 @@ public function getUserIdentifier(): string
         return $this->name;
     }
 
-    #[\Deprecated]
-    public function eraseCredentials(): void
-    {
-    }
-
     public function equals(UserInterface $user)
     {
     }
diff --git a/src/Symfony/Bundle/SecurityBundle/Tests/Functional/SecurityTest.php b/src/Symfony/Bundle/SecurityBundle/Tests/Functional/SecurityTest.php
@@ -249,11 +249,6 @@ public function isEnabled(): bool
     {
         return $this->enabled;
     }
-
-    #[\Deprecated]
-    public function eraseCredentials(): void
-    {
-    }
 }
 
 class ForceLoginController
diff --git a/src/Symfony/Component/Ldap/CHANGELOG.md b/src/Symfony/Component/Ldap/CHANGELOG.md
@@ -1,6 +1,11 @@
 CHANGELOG
 =========
 
+8.0
+---
+
+ * Remove `LdapUser::eraseCredentials()` in favor of `__serialize()`
+
 7.3
 ---
 
diff --git a/src/Symfony/Component/Ldap/Security/LdapUser.php b/src/Symfony/Component/Ldap/Security/LdapUser.php
@@ -60,15 +60,6 @@ public function getUserIdentifier(): string
         return $this->identifier;
     }
 
-    /**
-     * @deprecated since Symfony 7.3
-     */
-    #[\Deprecated(since: 'symfony/ldap 7.3')]
-    public function eraseCredentials(): void
-    {
-        $this->password = null;
-    }
-
     public function getExtraFields(): array
     {
         return $this->extraFields;
diff --git a/src/Symfony/Component/PasswordHasher/Tests/Fixtures/TestLegacyPasswordAuthenticatedUser.php b/src/Symfony/Component/PasswordHasher/Tests/Fixtures/TestLegacyPasswordAuthenticatedUser.php
@@ -35,11 +35,6 @@ public function getRoles(): array
         return $this->roles;
     }
 
-    #[\Deprecated]
-    public function eraseCredentials(): void
-    {
-    }
-
     public function getUserIdentifier(): string
     {
         return $this->username;
diff --git a/src/Symfony/Component/Security/Core/Authentication/Token/AbstractToken.php b/src/Symfony/Component/Security/Core/Authentication/Token/AbstractToken.php
@@ -55,20 +55,6 @@ public function setUser(UserInterface $user): void
         $this->user = $user;
     }
 
-    /**
-     * Removes sensitive information from the token.
-     *
-     * @deprecated since Symfony 7.3, erase credentials using the "__serialize()" method instead
-     */
-    public function eraseCredentials(): void
-    {
-        trigger_deprecation('symfony/security-core', '7.3', \sprintf('The "%s::eraseCredentials()" method is deprecated and will be removed in 8.0, erase credentials using the "__serialize()" method instead.', TokenInterface::class));
-
-        if ($this->getUser() instanceof UserInterface) {
-            $this->getUser()->eraseCredentials();
-        }
-    }
-
     /**
      * Returns all the necessary state of the object for serialization purposes.
      *
diff --git a/src/Symfony/Component/Security/Core/Authentication/Token/NullToken.php b/src/Symfony/Component/Security/Core/Authentication/Token/NullToken.php
@@ -43,14 +43,6 @@ public function getUserIdentifier(): string
         return '';
     }
 
-    /**
-     * @deprecated since Symfony 7.3
-     */
-    #[\Deprecated(since: 'symfony/security-core 7.3')]
-    public function eraseCredentials(): void
-    {
-    }
-
     public function getAttributes(): array
     {
         return [];
diff --git a/src/Symfony/Component/Security/Core/Authentication/Token/TokenInterface.php b/src/Symfony/Component/Security/Core/Authentication/Token/TokenInterface.php
@@ -57,13 +57,6 @@ public function getUser(): ?UserInterface;
      */
     public function setUser(UserInterface $user): void;
 
-    /**
-     * Removes sensitive information from the token.
-     *
-     * @deprecated since Symfony 7.3; erase credentials using the "__serialize()" method instead
-     */
-    public function eraseCredentials(): void;
-
     public function getAttributes(): array;
 
     /**
diff --git a/src/Symfony/Component/Security/Core/CHANGELOG.md b/src/Symfony/Component/Security/Core/CHANGELOG.md
@@ -1,6 +1,12 @@
 CHANGELOG
 =========
 
+8.0
+---
+
+ * Remove `UserInterface::eraseCredentials()` and `TokenInterface::eraseCredentials()`,
+  erase credentials e.g. using `__serialize()` instead
+
 7.3
 ---
 
diff --git a/src/Symfony/Component/Security/Core/Tests/Authentication/AuthenticationTrustResolverTest.php b/src/Symfony/Component/Security/Core/Tests/Authentication/AuthenticationTrustResolverTest.php
@@ -119,11 +119,6 @@ public function getUserIdentifier(): string
     {
     }
 
-    #[\Deprecated]
-    public function eraseCredentials(): void
-    {
-    }
-
     public function getAttributes(): array
     {
     }
diff --git a/src/Symfony/Component/Security/Core/Tests/Authentication/Token/AbstractTokenTest.php b/src/Symfony/Component/Security/Core/Tests/Authentication/Token/AbstractTokenTest.php
@@ -37,22 +37,6 @@ public static function provideUsers()
         yield [new InMemoryUser('fabien', null), 'fabien'];
     }
 
-    /**
-     * @group legacy
-     */
-    public function testEraseCredentials()
-    {
-        $token = new ConcreteToken(['ROLE_FOO']);
-
-        $user = $this->createMock(UserInterface::class);
-        $user->expects($this->once())->method('eraseCredentials');
-        $token->setUser($user);
-
-        $this->expectUserDeprecationMessage(\sprintf('Since symfony/security-core 7.3: The "%s::eraseCredentials()" method is deprecated and will be removed in 8.0, erase credentials using the "__serialize()" method instead.', TokenInterface::class));
-
-        $token->eraseCredentials();
-    }
-
     public function testSerialize()
     {
         $token = new ConcreteToken(['ROLE_FOO', 'ROLE_BAR']);
diff --git a/src/Symfony/Component/Security/Core/Tests/Authentication/Token/Fixtures/CustomUser.php b/src/Symfony/Component/Security/Core/Tests/Authentication/Token/Fixtures/CustomUser.php
@@ -35,9 +35,4 @@ public function getPassword(): ?string
     {
         return null;
     }
-
-    #[\Deprecated]
-    public function eraseCredentials(): void
-    {
-    }
 }
diff --git a/src/Symfony/Component/Security/Core/Tests/User/InMemoryUserTest.php b/src/Symfony/Component/Security/Core/Tests/User/InMemoryUserTest.php
@@ -56,17 +56,6 @@ public function testIsEnabled()
         $this->assertFalse($user->isEnabled());
     }
 
-    /**
-     * @group legacy
-     */
-    public function testEraseCredentials()
-    {
-        $user = new InMemoryUser('fabien', 'superpass');
-        $this->expectUserDeprecationMessage(\sprintf('Unsilenced deprecation: Method %s::eraseCredentials() is deprecated since symfony/security-core 7.3', InMemoryUser::class));
-        $user->eraseCredentials();
-        $this->assertEquals('superpass', $user->getPassword());
-    }
-
     public function testToString()
     {
         $user = new InMemoryUser('fabien', 'superpass');
diff --git a/src/Symfony/Component/Security/Core/User/InMemoryUser.php b/src/Symfony/Component/Security/Core/User/InMemoryUser.php
@@ -74,14 +74,6 @@ public function isEnabled(): bool
         return $this->enabled;
     }
 
-    /**
-     * @deprecated since Symfony 7.3
-     */
-    #[\Deprecated(since: 'symfony/security-core 7.3')]
-    public function eraseCredentials(): void
-    {
-    }
-
     public function isEqualTo(UserInterface $user): bool
     {
         if (!$user instanceof self) {
diff --git a/src/Symfony/Component/Security/Core/User/OAuth2User.php b/src/Symfony/Component/Security/Core/User/OAuth2User.php
@@ -63,8 +63,4 @@ public function getUserIdentifier(): string
     {
         return (string) ($this->sub ?? $this->username);
     }
-
-    public function eraseCredentials(): void
-    {
-    }
 }
diff --git a/src/Symfony/Component/Security/Core/User/OidcUser.php b/src/Symfony/Component/Security/Core/User/OidcUser.php
@@ -71,14 +71,6 @@ public function getUserIdentifier(): string
         return (string) ($this->userIdentifier ?? $this->getSub());
     }
 
-    /**
-     * @deprecated since Symfony 7.3
-     */
-    #[\Deprecated(since: 'symfony/security-core 7.3')]
-    public function eraseCredentials(): void
-    {
-    }
-
     public function getSub(): ?string
     {
         return $this->sub;
diff --git a/src/Symfony/Component/Security/Core/User/UserInterface.php b/src/Symfony/Component/Security/Core/User/UserInterface.php
@@ -47,16 +47,6 @@ interface UserInterface
      */
     public function getRoles(): array;
 
-    /**
-     * Removes sensitive data from the user.
-     *
-     * This is important if, at any given point, sensitive information like
-     * the plain-text password is stored on this object.
-     *
-     * @deprecated since Symfony 7.3, erase credentials using the "__serialize()" method instead
-     */
-    public function eraseCredentials(): void;
-
     /**
      * Returns the identifier for this user (e.g. username or email address).
      *
diff --git a/src/Symfony/Component/Security/Http/Authentication/AuthenticatorManager.php b/src/Symfony/Component/Security/Http/Authentication/AuthenticatorManager.php
@@ -209,10 +209,6 @@ private function executeAuthenticator(AuthenticatorInterface $authenticator, Req
             // announce the authentication token
             $authenticatedToken = $this->eventDispatcher->dispatch(new AuthenticationTokenCreatedEvent($authenticatedToken, $passport))->getAuthenticatedToken();
 
-            if ($this->eraseCredentials) {
-                self::checkEraseCredentials($authenticatedToken)?->eraseCredentials();
-            }
-
             $this->eventDispatcher->dispatch(new AuthenticationSuccessEvent($authenticatedToken), AuthenticationEvents::AUTHENTICATION_SUCCESS);
 
             $this->logger?->info('Authenticator successful!', ['token' => $authenticatedToken, 'authenticator' => ($authenticator instanceof TraceableAuthenticator ? $authenticator->getAuthenticator() : $authenticator)::class]);
@@ -288,41 +284,4 @@ private function isSensitiveException(AuthenticationException $exception): bool
 
         return false;
     }
-
-    /**
-     * @deprecated since Symfony 7.3
-     */
-    private static function checkEraseCredentials(TokenInterface|UserInterface|null $token): TokenInterface|UserInterface|null
-    {
-        if (!$token || !method_exists($token, 'eraseCredentials')) {
-            return null;
-        }
-
-        static $genericImplementations = [];
-        $m = null;
-
-        if (!isset($genericImplementations[$token::class])) {
-            $m = new \ReflectionMethod($token, 'eraseCredentials');
-            $genericImplementations[$token::class] = AbstractToken::class === $m->class;
-        }
-
-        if ($genericImplementations[$token::class]) {
-            return self::checkEraseCredentials($token->getUser());
-        }
-
-        static $deprecatedImplementations = [];
-
-        if (!isset($deprecatedImplementations[$token::class])) {
-            $m ??= new \ReflectionMethod($token, 'eraseCredentials');
-            $deprecatedImplementations[$token::class] = !$m->getAttributes(\Deprecated::class);
-        }
-
-        if ($deprecatedImplementations[$token::class]) {
-            trigger_deprecation('symfony/security-http', '7.3', 'Implementing "%s::eraseCredentials()" is deprecated since Symfony 7.3; add the #[\Deprecated] attribute on the method to signal its either empty or that you moved the logic elsewhere, typically to the "__serialize()" method.', get_debug_type($token));
-
-            return $token;
-        }
-
-        return null;
-    }
 }
diff --git a/src/Symfony/Component/Security/Http/Tests/Authentication/AuthenticatorManagerBCTest.php b/src/Symfony/Component/Security/Http/Tests/Authentication/AuthenticatorManagerBCTest.php
@@ -204,32 +204,6 @@ public function testAllRequiredBadgesPresent()
         $manager->authenticateRequest($this->request);
     }
 
-    /**
-     * @dataProvider provideEraseCredentialsData
-     *
-     * @group legacy
-     */
-    public function testEraseCredentials($eraseCredentials)
-    {
-        $authenticator = $this->createAuthenticator();
-        $this->request->attributes->set('_security_authenticators', [$authenticator]);
-
-        $authenticator->expects($this->any())->method('authenticate')->willReturn(new SelfValidatingPassport(new UserBadge('wouter', fn () => $this->user)));
-
-        $authenticator->expects($this->any())->method('createToken')->willReturn($this->token);
-
-        $this->token->expects($eraseCredentials ? $this->once() : $this->never())->method('eraseCredentials');
-
-        $manager = $this->createManager([$authenticator], 'main', $eraseCredentials, hideUserNotFoundExceptions: true);
-        $manager->authenticateRequest($this->request);
-    }
-
-    public static function provideEraseCredentialsData()
-    {
-        yield [true];
-        yield [false];
-    }
-
     /**
      * @group legacy
      */
diff --git a/src/Symfony/Component/Security/Http/Tests/Authentication/AuthenticatorManagerTest.php b/src/Symfony/Component/Security/Http/Tests/Authentication/AuthenticatorManagerTest.php
diff --git a/src/Symfony/Component/Security/Http/Tests/EventListener/PasswordMigratingListenerTest.php b/src/Symfony/Component/Security/Http/Tests/EventListener/PasswordMigratingListenerTest.php
diff --git a/src/Symfony/Component/Security/Http/Tests/Firewall/ContextListenerTest.php b/src/Symfony/Component/Security/Http/Tests/Firewall/ContextListenerTest.php
diff --git a/src/Symfony/Component/Security/Http/Tests/Fixtures/CustomUser.php b/src/Symfony/Component/Security/Http/Tests/Fixtures/CustomUser.php
diff --git a/src/Symfony/Component/Security/Http/Tests/LoginLink/LoginLinkHandlerTest.php b/src/Symfony/Component/Security/Http/Tests/LoginLink/LoginLinkHandlerTest.php

Original file line number	Diff line number	Diff line change
`@@ -45,11 +45,6 @@ public function getUserIdentifier(): string`
`45`	`45`	`return $this->name;`
`46`	`46`	`}`
`47`	`47`
`48`		`- #[\Deprecated]`
`49`		`- public function eraseCredentials(): void`
`50`		`- {`
`51`		`- }`
`52`		`-`
`53`	`48`	`public function equals(UserInterface $user)`
`54`	`49`	`{`
`55`	`50`	`}`
Original file line number	Diff line number	Diff line change
`@@ -249,11 +249,6 @@ public function isEnabled(): bool`
`249`	`249`	`{`
`250`	`250`	`return $this->enabled;`
`251`	`251`	`}`
`252`		`-`
`253`		`- #[\Deprecated]`
`254`		`- public function eraseCredentials(): void`
`255`		`- {`
`256`		`- }`
`257`	`252`	`}`
`258`	`253`
`259`	`254`	`class ForceLoginController`
Original file line number	Diff line number	Diff line change
`@@ -35,11 +35,6 @@ public function getRoles(): array`
`35`	`35`	`return $this->roles;`
`36`	`36`	`}`
`37`	`37`
`38`		`- #[\Deprecated]`
`39`		`- public function eraseCredentials(): void`
`40`		`- {`
`41`		`- }`
`42`		`-`
`43`	`38`	`public function getUserIdentifier(): string`
`44`	`39`	`{`
`45`	`40`	`return $this->username;`
Original file line number	Diff line number	Diff line change
`@@ -43,14 +43,6 @@ public function getUserIdentifier(): string`
`43`	`43`	`return '';`
`44`	`44`	`}`
`45`	`45`
`46`		`- /**`
`47`		`- * @deprecated since Symfony 7.3`
`48`		`- */`
`49`		`- #[\Deprecated(since: 'symfony/security-core 7.3')]`
`50`		`- public function eraseCredentials(): void`
`51`		`- {`
`52`		`- }`
`53`		`-`
`54`	`46`	`public function getAttributes(): array`
`55`	`47`	`{`
`56`	`48`	`return [];`