{"action":"created","issue":{"url":"https://api.github.com/repos/symfony/symfony/issues/25721","repository_url":"https://api.github.com/repos/symfony/symfony","labels_url":"https://api.github.com/repos/symfony/symfony/issues/25721/labels{/name}","comments_url":"https://api.github.com/repos/symfony/symfony/issues/25721/comments","events_url":"https://api.github.com/repos/symfony/symfony/issues/25721/events","html_url":"https://github.com/symfony/symfony/pull/25721","id":286874110,"number":25721,"title":"[Security] Removes Doctrine user provider assumption that an invalid User can't be handled at all","user":{"login":"iisisrael","id":932987,"avatar_url":"https://avatars3.githubusercontent.com/u/932987?v=4","gravatar_id":"","url":"https://api.github.com/users/iisisrael","html_url":"https://github.com/iisisrael","followers_url":"https://api.github.com/users/iisisrael/followers","following_url":"https://api.github.com/users/iisisrael/following{/other_user}","gists_url":"https://api.github.com/users/iisisrael/gists{/gist_id}","starred_url":"https://api.github.com/users/iisisrael/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/iisisrael/subscriptions","organizations_url":"https://api.github.com/users/iisisrael/orgs","repos_url":"https://api.github.com/users/iisisrael/repos","events_url":"https://api.github.com/users/iisisrael/events{/privacy}","received_events_url":"https://api.github.com/users/iisisrael/received_events","type":"User","site_admin":false},"labels":[{"id":100079,"url":"https://api.github.com/repos/symfony/symfony/labels/Bug","name":"Bug","color":"e10c02","default":false},{"id":99600,"url":"https://api.github.com/repos/symfony/symfony/labels/Security","name":"Security","color":"DDDDDD","default":false},{"id":237003792,"url":"https://api.github.com/repos/symfony/symfony/labels/Status:%20Needs%20Review","name":"Status: Needs Review","color":"ededed","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":{"url":"https://api.github.com/repos/symfony/symfony/milestones/18","html_url":"https://github.com/symfony/symfony/milestone/18","labels_url":"https://api.github.com/repos/symfony/symfony/milestones/18/labels","id":3234645,"number":18,"title":"next","description":"https://symfony.com/roadmap?version=4.2#checker","creator":{"login":"nicolas-grekas","id":243674,"avatar_url":"https://avatars3.githubusercontent.com/u/243674?v=4","gravatar_id":"","url":"https://api.github.com/users/nicolas-grekas","html_url":"https://github.com/nicolas-grekas","followers_url":"https://api.github.com/users/nicolas-grekas/followers","following_url":"https://api.github.com/users/nicolas-grekas/following{/other_user}","gists_url":"https://api.github.com/users/nicolas-grekas/gists{/gist_id}","starred_url":"https://api.github.com/users/nicolas-grekas/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nicolas-grekas/subscriptions","organizations_url":"https://api.github.com/users/nicolas-grekas/orgs","repos_url":"https://api.github.com/users/nicolas-grekas/repos","events_url":"https://api.github.com/users/nicolas-grekas/events{/privacy}","received_events_url":"https://api.github.com/users/nicolas-grekas/received_events","type":"User","site_admin":false},"open_issues":136,"closed_issues":23,"state":"open","created_at":"2018-04-02T12:03:21Z","updated_at":"2018-05-30T12:33:15Z","due_on":null,"closed_at":null},"comments":8,"created_at":"2018-01-08T20:28:38Z","updated_at":"2018-05-30T16:00:11Z","closed_at":null,"author_association":"CONTRIBUTOR","pull_request":{"url":"https://api.github.com/repos/symfony/symfony/pulls/25721","html_url":"https://github.com/symfony/symfony/pull/25721","diff_url":"https://github.com/symfony/symfony/pull/25721.diff","patch_url":"https://github.com/symfony/symfony/pull/25721.patch"},"body":"| Q             | A\r\n| ------------- | ---\r\n| Branch?       | 2.7\r\n| Bug fix?      | yes\r\n| New feature?  | no\r\n| BC breaks?    | no\r\n| Deprecations? | no\r\n| Tests pass?   | yes\r\n| Fixed tickets | none\r\n| License       | MIT\r\n| Doc PR        | none\r\n\r\nSince Symfony 2.0, if the Doctrine Bridge `EntityUserProvider` detects a user without a valid ID, it throws an `\\InvalidArgumentException`, which is not caught by the Firewall `ContextListener` when iterating over all available user providers.  This assumes that an environment cannot be configured to handle such a case with a secondary firewall authenticator.\r\n\r\nBy throwing and subsequently catching a Symfony namespaced exception instead, the firewall handling can be customized with an additional user provider that throws a `UsernameNotFoundException` instead of an `UnsupportedUserException`.  The authentication then fails gracefully, allowing a secondary authenticator to make an attempt.\r\n\r\nThe real world scenario for this is where we have an API firewall that handles direct REST requests and AJAX requests from authenticated sessions (using the jQuery `$.ajax()` option `xhrFields: { withCredentials: true }`).  Without this change, the first AJAX request after authenticating in a browser fails on the `\\InvalidArgumentException`.  With this change, our custom API user provider can throw a `UsernameNotFoundException` (since it is allowed to try), and our `simple_preauth` authenticator is then allowed to find the user (identifying data stored in a cookie).\r\n\r\nI'm not sure if there's even an argument for calling this double authentication approach \"unusual\" as opposed to \"unorthodox\".  Our alternative is to refactor our front end to make stateless REST requests or perhaps add a controller layer with a separate route / firewall scheme that passes the logic handling to the API controllers.  I thought it worth submitting this at least as a conversation starter.\r\n  "},"comment":{"url":"https://api.github.com/repos/symfony/symfony/issues/comments/393217404","html_url":"https://github.com/symfony/symfony/pull/25721#issuecomment-393217404","issue_url":"https://api.github.com/repos/symfony/symfony/issues/25721","id":393217404,"user":{"login":"iisisrael","id":932987,"avatar_url":"https://avatars3.githubusercontent.com/u/932987?v=4","gravatar_id":"","url":"https://api.github.com/users/iisisrael","html_url":"https://github.com/iisisrael","followers_url":"https://api.github.com/users/iisisrael/followers","following_url":"https://api.github.com/users/iisisrael/following{/other_user}","gists_url":"https://api.github.com/users/iisisrael/gists{/gist_id}","starred_url":"https://api.github.com/users/iisisrael/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/iisisrael/subscriptions","organizations_url":"https://api.github.com/users/iisisrael/orgs","repos_url":"https://api.github.com/users/iisisrael/repos","events_url":"https://api.github.com/users/iisisrael/events{/privacy}","received_events_url":"https://api.github.com/users/iisisrael/received_events","type":"User","site_admin":false},"created_at":"2018-05-30T16:00:11Z","updated_at":"2018-05-30T16:00:11Z","author_association":"CONTRIBUTOR","body":"@stof , an AJAX request is being made from the primary domain to the \"api\" subdomain, which also allows for persistent sessions, not strictly REST / OAuth requests.  After logging in on the primary domain, the user still hasn't started a session on the api subdomain, so authentication is transported in a cookie available to both domains.\r\n\r\nOn the first AJAX request, the first authenticator will fail, but our second authenticator in the chain is aware that the cookie may exist.  So even if a user session is not active and a user ID is not detected by the Doctrine Bridge `EntityUserProvider`, it should still be possible to pass responsibility down the chain of authenticators.  This would allow our custom authenticator, which knows to check the cookie in that case, to do its thing.\r\n\r\nAfter the first AJAX request, and if authenticated by the cookie, the user session has started and this is no longer an issue.  (We also handle the flip side if a user logs out on the primary domain and then accesses the API via AJAX, or logs in as a different user in the interim, but that's unrelated to this issue.)"}}
{"actor":{"display_login":"iisisrael"}}