[Security] Deprecate AnonymousToken, non-UserInterface users, and token credentials

Author: wouterj

Controller/AbstractController.php

@@ -395,7 +395,7 @@ protected function getDoctrine(): ManagerRegistry
     /**
      * Get a user from the Security Token Storage.
      *
-     * @return UserInterface|object|null
+     * @return UserInterface|null
      *
      * @throws \LogicException If SecurityBundle is not available
      *
@@ -411,6 +411,7 @@ protected function getUser()
             return null;
         }
 
+        // @deprecated since 5.4, $user will always be a UserInterface instance
         if (!\is_object($user = $token->getUser())) {
             // e.g. anonymous authentication
             return null;

Tests/Controller/AbstractControllerTest.php

@@ -138,14 +138,17 @@ public function testForward()
     public function testGetUser()
     {
         $user = new InMemoryUser('user', 'pass');
-        $token = new UsernamePasswordToken($user, 'pass', 'default', ['ROLE_USER']);
+        $token = new UsernamePasswordToken($user, 'default', ['ROLE_USER']);
 
         $controller = $this->createController();
         $controller->setContainer($this->getContainerWithTokenStorage($token));
 
         $this->assertSame($controller->getUser(), $user);
     }
 
+    /**
+     * @group legacy
+     */
     public function testGetUserAnonymousUserConvertedToNull()
     {
         $token = new AnonymousToken('default', 'anon.');

composer.json

@@ -53,7 +53,7 @@
         "symfony/notifier": "^5.3|^6.0",
         "symfony/process": "^4.4|^5.0|^6.0",
         "symfony/rate-limiter": "^5.2|^6.0",
-        "symfony/security-bundle": "^5.3|^6.0",
+        "symfony/security-bundle": "^5.4|^6.0",
         "symfony/serializer": "^5.4|^6.0",
         "symfony/stopwatch": "^4.4|^5.0|^6.0",
         "symfony/string": "^5.0|^6.0",
@@ -89,7 +89,6 @@
         "symfony/property-access": "<5.3",
         "symfony/serializer": "<5.2",
         "symfony/security-csrf": "<5.3",
-        "symfony/security-core": "<5.3",
         "symfony/stopwatch": "<4.4",
         "symfony/translation": "<5.3",
         "symfony/twig-bridge": "<4.4",