[Security] Track session usage whenever a new token is set

[wouterj]

Q	A
Branch?	4.4
Bug fix?	yes
New feature?	no
Deprecations?	no
Tickets	Fix #36208
License	MIT
Doc PR	-

When using anonymous: lazy, the programatic login using the guard handler is broken. As the setToken() does not track usage, the index remains equal.

I tried fixing this more properly in e.g. the SessionStrategy::onAuthentication class, but I couldn't get it working (as $request->hasPreviousSession() returns false, the session strategy isn't called). setToken() can also not be made usage tracking afaics, because it would directly break (setToken(null) is called in ContextListener).

The current fix does however look really ugly, but I can't find anything better with my minor knowledge of this session usage tracking feature. I'm open for all ideas :)

[nicolas-grekas]

setToken(null) is called in ContextListener

Can't we make setToken increment the tracker when $token is not null?

[wouterj]

Can't we make setToken increment the tracker when $token is not null?

I just tried this (as it sounds like a nice solution), but without calling getToken() the TokenStorage::initializer() isn't called. This means ContextListener isn't called and thus usage tracking is not enabled in the UsageTrackingTokenStorage. So this can be fixed by also injecting the sessionTrackerEnabler in UsageTrackingTokenStorage. Is that preferred? (it seems a bit off, as it's then getting a closure injected call its own method)

Allowing setToken() to call the initializer before setting the token would completely remove the lazy feature (as setToken(null) is always called).

[fabpot]

Thank you @wouterj.