{"action":"created","issue":{"url":"https://api.github.com/repos/symfony/symfony/issues/27121","repository_url":"https://api.github.com/repos/symfony/symfony","labels_url":"https://api.github.com/repos/symfony/symfony/issues/27121/labels{/name}","comments_url":"https://api.github.com/repos/symfony/symfony/issues/27121/comments","events_url":"https://api.github.com/repos/symfony/symfony/issues/27121/events","html_url":"https://github.com/symfony/symfony/pull/27121","id":319488272,"number":27121,"title":"[Security] reusing AuthorizationChecker in AccessListener","user":{"login":"oleg-andreyev","id":1244112,"avatar_url":"https://avatars1.githubusercontent.com/u/1244112?v=4","gravatar_id":"","url":"https://api.github.com/users/oleg-andreyev","html_url":"https://github.com/oleg-andreyev","followers_url":"https://api.github.com/users/oleg-andreyev/followers","following_url":"https://api.github.com/users/oleg-andreyev/following{/other_user}","gists_url":"https://api.github.com/users/oleg-andreyev/gists{/gist_id}","starred_url":"https://api.github.com/users/oleg-andreyev/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/oleg-andreyev/subscriptions","organizations_url":"https://api.github.com/users/oleg-andreyev/orgs","repos_url":"https://api.github.com/users/oleg-andreyev/repos","events_url":"https://api.github.com/users/oleg-andreyev/events{/privacy}","received_events_url":"https://api.github.com/users/oleg-andreyev/received_events","type":"User","site_admin":false},"labels":[{"id":100378,"url":"https://api.github.com/repos/symfony/symfony/labels/Feature","name":"Feature","color":"02e10c","default":false},{"id":99600,"url":"https://api.github.com/repos/symfony/symfony/labels/Security","name":"Security","color":"DDDDDD","default":false},{"id":237003792,"url":"https://api.github.com/repos/symfony/symfony/labels/Status:%20Needs%20Review","name":"Status: Needs Review","color":"ededed","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":{"url":"https://api.github.com/repos/symfony/symfony/milestones/18","html_url":"https://github.com/symfony/symfony/milestone/18","labels_url":"https://api.github.com/repos/symfony/symfony/milestones/18/labels","id":3234645,"number":18,"title":"next","description":"https://symfony.com/roadmap?version=4.2#checker","creator":{"login":"nicolas-grekas","id":243674,"avatar_url":"https://avatars3.githubusercontent.com/u/243674?v=4","gravatar_id":"","url":"https://api.github.com/users/nicolas-grekas","html_url":"https://github.com/nicolas-grekas","followers_url":"https://api.github.com/users/nicolas-grekas/followers","following_url":"https://api.github.com/users/nicolas-grekas/following{/other_user}","gists_url":"https://api.github.com/users/nicolas-grekas/gists{/gist_id}","starred_url":"https://api.github.com/users/nicolas-grekas/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nicolas-grekas/subscriptions","organizations_url":"https://api.github.com/users/nicolas-grekas/orgs","repos_url":"https://api.github.com/users/nicolas-grekas/repos","events_url":"https://api.github.com/users/nicolas-grekas/events{/privacy}","received_events_url":"https://api.github.com/users/nicolas-grekas/received_events","type":"User","site_admin":false},"open_issues":137,"closed_issues":21,"state":"open","created_at":"2018-04-02T12:03:21Z","updated_at":"2018-05-29T13:17:09Z","due_on":null,"closed_at":null},"comments":17,"created_at":"2018-05-02T09:58:54Z","updated_at":"2018-05-29T15:25:28Z","closed_at":null,"author_association":"CONTRIBUTOR","pull_request":{"url":"https://api.github.com/repos/symfony/symfony/pulls/27121","html_url":"https://github.com/symfony/symfony/pull/27121","diff_url":"https://github.com/symfony/symfony/pull/27121.diff","patch_url":"https://github.com/symfony/symfony/pull/27121.patch"},"body":"| Q             | A\r\n| ------------- | ---\r\n| Branch?       | 3.4\r\n| Bug fix?      | yes\r\n| New feature?  | no\r\n| BC breaks?    | no\r\n| Deprecations? | no\r\n| Tests pass?   | yes\r\n| License       | MIT\r\n| Fixed tickets | #21571\r\n\r\nWhile investigating why `AuthenticationEvents::AUTHENTICATION_SUCCESS` is not dispatched, noticed similarity between `AccessListener` and `AuthorizationChecker` and the only real difference is `alwaysAuthenticate` flag.\r\n\r\n**Case 1:**\r\nWhen `UsernamePasswordToken` is serialized it will be serialized with state of `authenticated`,\r\nso when application will load token from session `AccessListener` won't call `authenticate` because `authenticated=true`, even if `alwaysAuthenticate=true`\r\n\r\n**Case 2:**\r\nUser A has roles `foo, bar and admin`, User A is signed-in into application and token is persisted, later another User B with role `admin`, decided to restrict role `admin` for User A, so User A won't lose it's privileges until session is expired or logout, because token is persisted with `roles` and `authenticated=true` and AccessListener does not call `authenticate` even if `alwaysAuthenticate=true`"},"comment":{"url":"https://api.github.com/repos/symfony/symfony/issues/comments/392818950","html_url":"https://github.com/symfony/symfony/pull/27121#issuecomment-392818950","issue_url":"https://api.github.com/repos/symfony/symfony/issues/27121","id":392818950,"user":{"login":"oleg-andreyev","id":1244112,"avatar_url":"https://avatars1.githubusercontent.com/u/1244112?v=4","gravatar_id":"","url":"https://api.github.com/users/oleg-andreyev","html_url":"https://github.com/oleg-andreyev","followers_url":"https://api.github.com/users/oleg-andreyev/followers","following_url":"https://api.github.com/users/oleg-andreyev/following{/other_user}","gists_url":"https://api.github.com/users/oleg-andreyev/gists{/gist_id}","starred_url":"https://api.github.com/users/oleg-andreyev/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/oleg-andreyev/subscriptions","organizations_url":"https://api.github.com/users/oleg-andreyev/orgs","repos_url":"https://api.github.com/users/oleg-andreyev/repos","events_url":"https://api.github.com/users/oleg-andreyev/events{/privacy}","received_events_url":"https://api.github.com/users/oleg-andreyev/received_events","type":"User","site_admin":false},"created_at":"2018-05-29T15:25:28Z","updated_at":"2018-05-29T15:25:28Z","author_association":"CONTRIBUTOR","body":"Changed base to 3.4."}}
{"actor":{"display_login":"oleg-andreyev"}}