{"action":"created","issue":{"url":"https://api.github.com/repos/symfony/symfony/issues/25992","repository_url":"https://api.github.com/repos/symfony/symfony","labels_url":"https://api.github.com/repos/symfony/symfony/issues/25992/labels{/name}","comments_url":"https://api.github.com/repos/symfony/symfony/issues/25992/comments","events_url":"https://api.github.com/repos/symfony/symfony/issues/25992/events","html_url":"https://github.com/symfony/symfony/issues/25992","id":293197181,"number":25992,"title":"[Guard] Failed authentication attempt when authenticated, de-authenticates","user":{"login":"iltar","id":1754678,"avatar_url":"https://avatars0.githubusercontent.com/u/1754678?v=4","gravatar_id":"","url":"https://api.github.com/users/iltar","html_url":"https://github.com/iltar","followers_url":"https://api.github.com/users/iltar/followers","following_url":"https://api.github.com/users/iltar/following{/other_user}","gists_url":"https://api.github.com/users/iltar/gists{/gist_id}","starred_url":"https://api.github.com/users/iltar/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/iltar/subscriptions","organizations_url":"https://api.github.com/users/iltar/orgs","repos_url":"https://api.github.com/users/iltar/repos","events_url":"https://api.github.com/users/iltar/events{/privacy}","received_events_url":"https://api.github.com/users/iltar/received_events","type":"User","site_admin":false},"labels":[{"id":100079,"url":"https://api.github.com/repos/symfony/symfony/labels/Bug","name":"Bug","color":"e10c02","default":false},{"id":99600,"url":"https://api.github.com/repos/symfony/symfony/labels/Security","name":"Security","color":"DDDDDD","default":false},{"id":237003792,"url":"https://api.github.com/repos/symfony/symfony/labels/Status:%20Needs%20Review","name":"Status: Needs Review","color":"ededed","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2018-01-31T15:21:09Z","updated_at":"2018-02-01T01:20:35Z","closed_at":null,"author_association":"CONTRIBUTOR","body":"| Q                | A\r\n| ---------------- | -----\r\n| Bug report?      | yes\r\n| Feature request? | no\r\n| BC Break report? | no\r\n| RFC?             | no\r\n| Symfony version  | 2.8+\r\n\r\nMy scenario:\r\n - I have a firewall\r\n - Which has 3 authenticators\r\n - Entry for one of the authenticators: `/hash/{hash}/`\r\n - Authenticates on the main firewall\r\n - A voter restricts access for this authentication (same firewall context)\r\n - When access denied by that voter, an in-page login screen will ask for the password to \"elevate permissions\"\r\n - Successful authentication will grant you normal permissions, difference is that username is not required\r\n\r\nThe issue I have now that I'm using guard instead of Simple*, is that _every_ failed authentication attempt, triggers a de-authentication. That means that instead of staying logged in and showing the error message that the password was wrong, the user is logged out and has to fill in both password and username. \r\n\r\nThis is really simple to reproduce, just try to login with invalid credentials when logged in, and it will de-authenticate you.\r\n\r\nFor this particular case, it can be solved by removing the following lines: https://github.com/symfony/symfony/blob/master/src/Symfony/Component/Security/Guard/GuardAuthenticatorHandler.php#L100-L103\r\n\r\nI think this is a bug, as it's really weird behavior to de-authenticate a user this way. I can provide a PR to fix this in 2.8, otherwise it has to be fixed with a deprecation in 4.1 (which would take too long for my issue though).\r\n\r\nhttps://github.com/symfony/symfony/commit/231744370849df57ff7032e0246fc882d9c26220\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/symfony/symfony/issues/comments/362126825","html_url":"https://github.com/symfony/symfony/issues/25992#issuecomment-362126825","issue_url":"https://api.github.com/repos/symfony/symfony/issues/25992","id":362126825,"user":{"login":"curry684","id":1455673,"avatar_url":"https://avatars0.githubusercontent.com/u/1455673?v=4","gravatar_id":"","url":"https://api.github.com/users/curry684","html_url":"https://github.com/curry684","followers_url":"https://api.github.com/users/curry684/followers","following_url":"https://api.github.com/users/curry684/following{/other_user}","gists_url":"https://api.github.com/users/curry684/gists{/gist_id}","starred_url":"https://api.github.com/users/curry684/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/curry684/subscriptions","organizations_url":"https://api.github.com/users/curry684/orgs","repos_url":"https://api.github.com/users/curry684/repos","events_url":"https://api.github.com/users/curry684/events{/privacy}","received_events_url":"https://api.github.com/users/curry684/received_events","type":"User","site_admin":false},"created_at":"2018-02-01T01:20:35Z","updated_at":"2018-02-01T01:20:35Z","author_association":"CONTRIBUTOR","body":"> I can't think of any reason why the token should be set to null when you fail authentication\r\n\r\nDoesn't this happen when elevating by requiring `IS_AUTHENTICATED_FULLY` in a `IS_AUTHENTICATED_REMEMBERED` setting? I would certainly expect those cases to cause logout if failed, as it could indicate a session hijack."}}
{"actor":{"display_login":"curry684"}}