Hide username and client ip in logs

Spomky · Spomky · commit d4521f2dac94 · 2023-08-21T14:04:11.000+02:00
diff --git a/src/Symfony/Bundle/SecurityBundle/DependencyInjection/Security/Factory/LoginThrottlingFactory.php b/src/Symfony/Bundle/SecurityBundle/DependencyInjection/Security/Factory/LoginThrottlingFactory.php
@@ -76,6 +76,7 @@ public function createAuthenticator(ContainerBuilder $container, string $firewal
             $container->register($config['limiter'] = 'security.login_throttling.'.$firewallName.'.limiter', DefaultLoginRateLimiter::class)
                 ->addArgument(new Reference('limiter.'.$globalId))
                 ->addArgument(new Reference('limiter.'.$localId))
+                ->addArgument('%kernel.secret%')
             ;
         }
 
diff --git a/src/Symfony/Component/Security/Http/RateLimiter/DefaultLoginRateLimiter.php b/src/Symfony/Component/Security/Http/RateLimiter/DefaultLoginRateLimiter.php
@@ -28,11 +28,19 @@ final class DefaultLoginRateLimiter extends AbstractRequestRateLimiter
 {
     private RateLimiterFactory $globalFactory;
     private RateLimiterFactory $localFactory;
+    private string $secret;
 
-    public function __construct(RateLimiterFactory $globalFactory, RateLimiterFactory $localFactory)
+    /**
+     * @param non-empty-string $secret A secret to use for hashing the IP address and username
+     */
+    public function __construct(RateLimiterFactory $globalFactory, RateLimiterFactory $localFactory, #[\SensitiveParameter] string $secret = '')
     {
+        if (!$secret) {// @deprecated remove this catch block in 7.0 and make $secret mandatory.
+            trigger_deprecation('symfony/security-http', '6.4', 'Calling "%s()" with an empty secret is deprecated. A non-empty secret will be mandatory in version 7.0.', __METHOD__);
+        }
         $this->globalFactory = $globalFactory;
         $this->localFactory = $localFactory;
+        $this->secret = $secret;
     }
 
     protected function getLimiters(Request $request): array
@@ -45,4 +53,9 @@ protected function getLimiters(Request $request): array
             $this->localFactory->create($username.'-'.$request->getClientIp()),
         ];
     }
+
+    private function hash(string $data): string
+    {
+        return strtr(substr(base64_encode(hash_hmac('sha256', $data, $this->secret, true)), 0, 8), '/+', '._');
+    }
 }
diff --git a/src/Symfony/Component/Security/Http/Tests/EventListener/LoginThrottlingListenerTest.php b/src/Symfony/Component/Security/Http/Tests/EventListener/LoginThrottlingListenerTest.php
@@ -47,7 +47,7 @@ protected function setUp(): void
             'limit' => 6,
             'interval' => '1 minute',
         ], new InMemoryStorage());
-        $limiter = new DefaultLoginRateLimiter($globalLimiter, $localLimiter);
+        $limiter = new DefaultLoginRateLimiter($globalLimiter, $localLimiter, '$3cre7');
 
         $this->listener = new LoginThrottlingListener($this->requestStack, $limiter);
     }

Original file line number	Diff line number	Diff line change
`@@ -76,6 +76,7 @@ public function createAuthenticator(ContainerBuilder $container, string $firewal`
`76`	`76`	`$container->register($config['limiter'] = 'security.login_throttling.'.$firewallName.'.limiter', DefaultLoginRateLimiter::class)`
`77`	`77`	`->addArgument(new Reference('limiter.'.$globalId))`
`78`	`78`	`->addArgument(new Reference('limiter.'.$localId))`
	`79`	`+ ->addArgument('%kernel.secret%')`
`79`	`80`	`;`
`80`	`81`	`}`
`81`	`82`
Original file line number	Diff line number	Diff line change
`@@ -28,11 +28,19 @@ final class DefaultLoginRateLimiter extends AbstractRequestRateLimiter`
`28`	`28`	`{`
`29`	`29`	`private RateLimiterFactory $globalFactory;`
`30`	`30`	`private RateLimiterFactory $localFactory;`
	`31`	`+ private string $secret;`
`31`	`32`
`32`		`- public function __construct(RateLimiterFactory $globalFactory, RateLimiterFactory $localFactory)`
	`33`	`+ /**`
	`34`	`+ * @param non-empty-string $secret A secret to use for hashing the IP address and username`
	`35`	`+ */`
	`36`	`+ public function __construct(RateLimiterFactory $globalFactory, RateLimiterFactory $localFactory, #[\SensitiveParameter] string $secret = '')`
`33`	`37`	`{`
	`38`	`+ if (!$secret) {// @deprecated remove this catch block in 7.0 and make $secret mandatory.`
	`39`	`+ trigger_deprecation('symfony/security-http', '6.4', 'Calling "%s()" with an empty secret is deprecated. A non-empty secret will be mandatory in version 7.0.', __METHOD__);`
	`40`	`+ }`
`34`	`41`	`$this->globalFactory = $globalFactory;`
`35`	`42`	`$this->localFactory = $localFactory;`
	`43`	`+ $this->secret = $secret;`
`36`	`44`	`}`
`37`	`45`
`38`	`46`	`protected function getLimiters(Request $request): array`
`@@ -45,4 +53,9 @@ protected function getLimiters(Request $request): array`
`45`	`53`	`$this->localFactory->create($username.'-'.$request->getClientIp()),`
`46`	`54`	`];`
`47`	`55`	`}`
	`56`	`+`
	`57`	`+ private function hash(string $data): string`
	`58`	`+ {`
	`59`	`+ return strtr(substr(base64_encode(hash_hmac('sha256', $data, $this->secret, true)), 0, 8), '/+', '._');`
	`60`	`+ }`
`48`	`61`	`}`
Original file line number	Diff line number	Diff line change
`@@ -47,7 +47,7 @@ protected function setUp(): void`
`47`	`47`	`'limit' => 6,`
`48`	`48`	`'interval' => '1 minute',`
`49`	`49`	`], new InMemoryStorage());`
`50`		`- $limiter = new DefaultLoginRateLimiter($globalLimiter, $localLimiter);`
	`50`	`+ $limiter = new DefaultLoginRateLimiter($globalLimiter, $localLimiter, '$3cre7');`
`51`	`51`
`52`	`52`	`$this->listener = new LoginThrottlingListener($this->requestStack, $limiter);`
`53`	`53`	`}`