Hiding userFqcn in RememberMe cookie

thereisnobugs · thereisnobugs · commit 5851eee75316 · 2025-01-20T16:58:24.000+03:00
diff --git a/src/Symfony/Component/Security/Http/CHANGELOG.md b/src/Symfony/Component/Security/Http/CHANGELOG.md
@@ -3,7 +3,7 @@ CHANGELOG
 
 7.3
 ---
-
+ * Rename property userFqcn to userFqcnHash, remove method getUserFqcn, add method getUserFqcnHash.
  * Add encryption support to `OidcTokenHandler` (JWE)
 
 7.2
diff --git a/src/Symfony/Component/Security/Http/RememberMe/PersistentRememberMeHandler.php b/src/Symfony/Component/Security/Http/RememberMe/PersistentRememberMeHandler.php
@@ -67,7 +67,7 @@ public function consumeRememberMeCookie(RememberMeDetails $rememberMeDetails): U
         [$series, $tokenValue] = explode(':', $rememberMeDetails->getValue(), 2);
         $persistentToken = $this->tokenProvider->loadTokenBySeries($series);
 
-        if ($persistentToken->getUserIdentifier() !== $rememberMeDetails->getUserIdentifier() || $persistentToken->getClass() !== $rememberMeDetails->getUserFqcn()) {
+        if ($persistentToken->getUserIdentifier() !== $rememberMeDetails->getUserIdentifier() || !hash_equals(RememberMeDetails::computeUserFqcnHash($persistentToken->getClass()), $rememberMeDetails->getUserFqcnHash())) {
             throw new AuthenticationException('The cookie\'s hash is invalid.');
         }
 
diff --git a/src/Symfony/Component/Security/Http/RememberMe/RememberMeDetails.php b/src/Symfony/Component/Security/Http/RememberMe/RememberMeDetails.php
@@ -22,7 +22,7 @@ class RememberMeDetails
     public const COOKIE_DELIMITER = ':';
 
     public function __construct(
-        private string $userFqcn,
+        private string $userFqcnHash,
         private string $userIdentifier,
         private int $expires,
         private string $value,
@@ -48,7 +48,12 @@ public static function fromRawCookie(string $rawCookie): self
 
     public static function fromPersistentToken(PersistentToken $persistentToken, int $expires): self
     {
-        return new static($persistentToken->getClass(), $persistentToken->getUserIdentifier(), $expires, $persistentToken->getSeries().':'.$persistentToken->getTokenValue());
+        return new static(self::computeUserFqcnHash($persistentToken->getClass()), $persistentToken->getUserIdentifier(), $expires, $persistentToken->getSeries().':'.$persistentToken->getTokenValue());
+    }
+
+    public static function computeUserFqcnHash(string $userFqcn): string
+    {
+        return hash('sha256', $userFqcn);
     }
 
     public function withValue(string $value): self
@@ -59,9 +64,9 @@ public function withValue(string $value): self
         return $details;
     }
 
-    public function getUserFqcn(): string
+    public function getUserFqcnHash(): string
     {
-        return $this->userFqcn;
+        return $this->userFqcnHash;
     }
 
     public function getUserIdentifier(): string
@@ -82,6 +87,6 @@ public function getValue(): string
     public function toString(): string
     {
         // $userIdentifier is encoded because it might contain COOKIE_DELIMITER, we assume other values don't
-        return implode(self::COOKIE_DELIMITER, [strtr($this->userFqcn, '\\', '.'), strtr(base64_encode($this->userIdentifier), '+/=', '-_~'), $this->expires, $this->value]);
+        return implode(self::COOKIE_DELIMITER, [$this->userFqcnHash, strtr(base64_encode($this->userIdentifier), '+/=', '-_~'), $this->expires, $this->value]);
     }
 }

Original file line number	Diff line number	Diff line change
`@@ -67,7 +67,7 @@ public function consumeRememberMeCookie(RememberMeDetails $rememberMeDetails): U`
`67`	`67`	`[$series, $tokenValue] = explode(':', $rememberMeDetails->getValue(), 2);`
`68`	`68`	`$persistentToken = $this->tokenProvider->loadTokenBySeries($series);`
`69`	`69`
`70`		`- if ($persistentToken->getUserIdentifier() !== $rememberMeDetails->getUserIdentifier() \|\| $persistentToken->getClass() !== $rememberMeDetails->getUserFqcn()) {`
	`70`	`+ if ($persistentToken->getUserIdentifier() !== $rememberMeDetails->getUserIdentifier() \|\| !hash_equals(RememberMeDetails::computeUserFqcnHash($persistentToken->getClass()), $rememberMeDetails->getUserFqcnHash())) {`
`71`	`71`	`throw new AuthenticationException('The cookie\'s hash is invalid.');`
`72`	`72`	`}`
`73`	`73`
Original file line number	Diff line number	Diff line change
`@@ -22,7 +22,7 @@ class RememberMeDetails`
`22`	`22`	`public const COOKIE_DELIMITER = ':';`
`23`	`23`
`24`	`24`	`public function __construct(`
`25`		`- private string $userFqcn,`
	`25`	`+ private string $userFqcnHash,`
`26`	`26`	`private string $userIdentifier,`
`27`	`27`	`private int $expires,`
`28`	`28`	`private string $value,`
`@@ -48,7 +48,12 @@ public static function fromRawCookie(string $rawCookie): self`
`48`	`48`
`49`	`49`	`public static function fromPersistentToken(PersistentToken $persistentToken, int $expires): self`
`50`	`50`	`{`
`51`		`- return new static($persistentToken->getClass(), $persistentToken->getUserIdentifier(), $expires, $persistentToken->getSeries().':'.$persistentToken->getTokenValue());`
	`51`	`+ return new static(self::computeUserFqcnHash($persistentToken->getClass()), $persistentToken->getUserIdentifier(), $expires, $persistentToken->getSeries().':'.$persistentToken->getTokenValue());`
	`52`	`+ }`
	`53`	`+`
	`54`	`+ public static function computeUserFqcnHash(string $userFqcn): string`
	`55`	`+ {`
	`56`	`+ return hash('sha256', $userFqcn);`
`52`	`57`	`}`
`53`	`58`
`54`	`59`	`public function withValue(string $value): self`
`@@ -59,9 +64,9 @@ public function withValue(string $value): self`
`59`	`64`	`return $details;`
`60`	`65`	`}`
`61`	`66`
`62`		`- public function getUserFqcn(): string`
	`67`	`+ public function getUserFqcnHash(): string`
`63`	`68`	`{`
`64`		`- return $this->userFqcn;`
	`69`	`+ return $this->userFqcnHash;`
`65`	`70`	`}`
`66`	`71`
`67`	`72`	`public function getUserIdentifier(): string`
`@@ -82,6 +87,6 @@ public function getValue(): string`
`82`	`87`	`public function toString(): string`
`83`	`88`	`{`
`84`	`89`	`// $userIdentifier is encoded because it might contain COOKIE_DELIMITER, we assume other values don't`
`85`		`- return implode(self::COOKIE_DELIMITER, [strtr($this->userFqcn, '\\', '.'), strtr(base64_encode($this->userIdentifier), '+/=', '-_~'), $this->expires, $this->value]);`
	`90`	`+ return implode(self::COOKIE_DELIMITER, [$this->userFqcnHash, strtr(base64_encode($this->userIdentifier), '+/=', '-_~'), $this->expires, $this->value]);`
`86`	`91`	`}`
`87`	`92`	`}`