[SecurityBundle] Link to the profile the token was (de)authenticated

MatTheCat · MatTheCat · commit e3bd133ce0e5 · 2024-07-09T19:19:17.000+02:00
diff --git a/src/Symfony/Bundle/SecurityBundle/DataCollector/SecurityDataCollector.php b/src/Symfony/Bundle/SecurityBundle/DataCollector/SecurityDataCollector.php
@@ -13,6 +13,7 @@
 
 use Symfony\Bundle\SecurityBundle\Debug\TraceableFirewallListener;
 use Symfony\Bundle\SecurityBundle\Security\FirewallMap;
+use Symfony\Component\HttpFoundation\Cookie;
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\Response;
 use Symfony\Component\HttpKernel\DataCollector\DataCollector;
@@ -195,6 +196,27 @@ public function collect(Request $request, Response $response, ?\Throwable $excep
         }
 
         $this->data['authenticators'] = $this->firewall ? $this->firewall->getAuthenticatorsInfo() : [];
+
+        if ($this->data['listeners'] && !($this->data['firewall']['stateless'] ?? true)) {
+            $authCookieName = "{$this->data['firewall']['name']}_auth_profile_token";
+            $deauthCookieName = "{$this->data['firewall']['name']}_deauth_profile_token";
+            $profileToken = $response->headers->get('X-Debug-Token');
+
+            $this->data['auth_profile_token'] = $request->cookies->get($authCookieName);
+            $this->data['deauth_profile_token'] = $request->cookies->get($deauthCookieName);
+
+            if ($this->data['authenticated'] && !$this->data['auth_profile_token']) {
+                $response->headers->setCookie(new Cookie($authCookieName, $profileToken));
+
+                $this->data['deauth_profile_token'] = null;
+                $response->headers->clearCookie($deauthCookieName);
+            } elseif(!$this->data['authenticated'] && !$this->data['deauth_profile_token']) {
+                $response->headers->setCookie(new Cookie($deauthCookieName, $profileToken));
+
+                $this->data['auth_profile_token'] = null;
+                $response->headers->clearCookie($authCookieName);
+            }
+        }
     }
 
     public function reset(): void
@@ -339,6 +361,16 @@ public function getAuthenticators(): array|Data
         return $this->data['authenticators'];
     }
 
+    public function getAuthProfileToken(): string|Data|null
+    {
+        return $this->data['auth_profile_token'] ?? null;
+    }
+
+    public function getDeauthProfileToken(): string|Data|null
+    {
+        return $this->data['deauth_profile_token'] ?? null;
+    }
+
     public function getName(): string
     {
         return 'security';
diff --git a/src/Symfony/Bundle/SecurityBundle/Resources/views/Collector/security.html.twig b/src/Symfony/Bundle/SecurityBundle/Resources/views/Collector/security.html.twig
@@ -181,6 +181,17 @@
                                 <span class="value">{{ source('@WebProfiler/Icon/' ~ (collector.authenticated ? 'yes' : 'no') ~ '.svg') }}</span>
                                 <span class="label">Authenticated</span>
                             </div>
+
+                            {% if collector.authProfileToken %}
+                                <div class="metric">
+                                    <span class="value">
+                                        <a href="{{ path('_profiler', {token: collector.authProfileToken, panel: 'security'}) }}">
+                                            {{- collector.authProfileToken -}}
+                                        </a>
+                                    </span>
+                                    <span class="label">From</span>
+                                </div>
+                            {% endif %}
                         </div>
 
                         <table>
@@ -219,7 +230,15 @@
                         </table>
                     {% elseif collector.enabled %}
                         <div class="empty">
-                            <p>There is no security token.</p>
+                            <p>
+                                There is no security token.
+                                {% if collector.deauthProfileToken %}
+                                    It was removed in
+                                    <a href="{{ path('_profiler', {token: collector.deauthProfileToken, panel: 'security'}) }}">
+                                        {{- collector.deauthProfileToken -}}
+                                    </a>.
+                                {% endif %}
+                            </p>
                         </div>
                     {% endif %}
                 </div>
