From 9bb1230525b32fa20ed8abce429f931c90a1776c Mon Sep 17 00:00:00 2001 From: Koen Reiniers Date: Mon, 23 Mar 2020 11:51:31 +0100 Subject: [PATCH] [Security] Check if firewall is stateless before checking for session/previous session --- .../Guard/GuardAuthenticatorHandler.php | 2 +- .../Tests/GuardAuthenticatorHandlerTest.php | 19 +++++++++++++++++++ 2 files changed, 20 insertions(+), 1 deletion(-) diff --git a/src/Symfony/Component/Security/Guard/GuardAuthenticatorHandler.php b/src/Symfony/Component/Security/Guard/GuardAuthenticatorHandler.php index 977442aa931b..356547df2b30 100644 --- a/src/Symfony/Component/Security/Guard/GuardAuthenticatorHandler.php +++ b/src/Symfony/Component/Security/Guard/GuardAuthenticatorHandler.php @@ -134,7 +134,7 @@ public function setSessionAuthenticationStrategy(SessionAuthenticationStrategyIn private function migrateSession(Request $request, TokenInterface $token, $providerKey) { - if (!$this->sessionStrategy || !$request->hasSession() || !$request->hasPreviousSession() || \in_array($providerKey, $this->statelessProviderKeys, true)) { + if (\in_array($providerKey, $this->statelessProviderKeys, true) || !$this->sessionStrategy || !$request->hasSession() || !$request->hasPreviousSession()) { return; } diff --git a/src/Symfony/Component/Security/Guard/Tests/GuardAuthenticatorHandlerTest.php b/src/Symfony/Component/Security/Guard/Tests/GuardAuthenticatorHandlerTest.php index 7fe29cacc0fc..74227e37c1b3 100644 --- a/src/Symfony/Component/Security/Guard/Tests/GuardAuthenticatorHandlerTest.php +++ b/src/Symfony/Component/Security/Guard/Tests/GuardAuthenticatorHandlerTest.php @@ -149,6 +149,25 @@ public function testSessionStrategyIsNotCalledWhenStateless() $handler->authenticateWithToken($this->token, $this->request, 'some_provider_key'); } + /** + * @requires function \Symfony\Component\HttpFoundation\Request::setSessionFactory + */ + public function testSessionIsNotInstantiatedOnStatelessFirewall() + { + $sessionFactory = $this->getMockBuilder(\stdClass::class) + ->setMethods(['__invoke']) + ->getMock(); + + $sessionFactory->expects($this->never()) + ->method('__invoke'); + + $this->request->setSessionFactory($sessionFactory); + + $handler = new GuardAuthenticatorHandler($this->tokenStorage, $this->dispatcher, ['stateless_provider_key']); + $handler->setSessionAuthenticationStrategy($this->sessionStrategy); + $handler->authenticateWithToken($this->token, $this->request, 'stateless_provider_key'); + } + protected function setUp() { $this->tokenStorage = $this->getMockBuilder('Symfony\Component\Security\Core\Authentication\Token\Storage\TokenStorageInterface')->getMock();