Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

new security authenticator fails #37033

Closed
bitgandtter opened this issue Jun 1, 2020 · 5 comments
Closed

new security authenticator fails #37033

bitgandtter opened this issue Jun 1, 2020 · 5 comments
Labels
Bug Security Status: Needs Review

Comments

@bitgandtter
Copy link
Contributor

bitgandtter commented Jun 1, 2020 •
edited

Symfony version(s) affected: 5.1

Description
after enabled enable_authenticator_manager: true i got The service "security.listener.csrf_protection" has a dependency on a non-existent service "security.csrf.token_manager".

Minimal project with issue https://github.com/bitgandtter/sf-security
@bitgandtter bitgandtter added the Bug label Jun 1, 2020
@wouterj
Copy link
Member

wouterj commented Jun 1, 2020

Thanks for testing the new system!

Can you please show some context (configuration of framework.csrf and security or - preferably - a minimal application that reproduces the error)?

@bitgandtter
Copy link
Contributor Author

@wouterj i updated the issue with a link to the minimal project

@wouterj wouterj mentioned this issue Jun 1, 2020
Merged
@wouterj
Copy link
Member

wouterj commented Jun 1, 2020

Thanks for your quick response! I've submitted a fix: #37047 I'm amazed that I've always tested the new system in a Symfony app with CSRF enabled 😄

@fabpot fabpot closed this as completed Jun 3, 2020
fabpot added a commit that referenced this issue Jun 3, 2020
@fabpot
bug #37047 [SecurityBundle] Only register CSRF protection listener if…
d341254 
… CSRF is available (wouterj)

This PR was merged into the 5.1 branch.

Discussion
----------

[SecurityBundle] Only register CSRF protection listener if CSRF is available

| Q             | A
| ------------- | ---
| Branch?       | 5.1
| Bug fix?      | yes
| New feature?  | no
| Deprecations? | yes
| Tickets       | Fix #37033
| License       | MIT
| Doc PR        | -

I know we're not allowed to add new deprecations in already released versions. However, I don't think anyone is using SecurityBundle's compiler passes except from Symfony itself - so I don't think anyone is affected by this deprecation. The alternatives would be:

* Add a new compiler pass in 5.1 that conditionally registers the CSRF listener
* Do this exact change in 5.2 and...
  * accept a `null` argument in the listener for 5.1
  * or add this to the `RegisterCsrfTokenClearingLogoutHandlerPass` class in 5.1

Commits
-------

2d738b3 Only register CSRF protection listener if CSRF is available
@umpirsky
Copy link
Contributor

umpirsky commented Jan 4, 2024 •
edited

Strange, but I still get:

  [Symfony\Component\DependencyInjection\Exception\ServiceNotFoundException]                                                 
  The service "security.listener.csrf_protection" has a dependency on a non-existent service "security.csrf.token_manager".

in Symfony v5.4.25. Both !$container->has('security.authenticator.manager') and !$container->has('security.csrf.token_manager') are false in RegisterCsrfFeaturesPass::registerCsrfProtectionListener(), but I still get an error.

@xabbuh
Copy link
Member

xabbuh commented Jan 4, 2024

please open a new issue and provide a small example application that allows to reproduce it

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
Bug Security Status: Needs Review
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
7 participants
@fabpot @javiereguiluz @umpirsky @wouterj @bitgandtter @xabbuh @carsonbot