Hide sensitive information with SensitiveParameter attribute

Author: GromNaN

Authentication/RememberMe/CacheTokenVerifier.php

@@ -38,7 +38,7 @@ public function __construct(CacheItemPoolInterface $cache, int $outdatedTokenTtl
     /**
      * {@inheritdoc}
      */
-    public function verifyToken(PersistentTokenInterface $token, string $tokenValue): bool
+    public function verifyToken(PersistentTokenInterface $token, #[\SensitiveParameter] string $tokenValue): bool
     {
         if (hash_equals($token->getTokenValue(), $tokenValue)) {
             return true;
@@ -58,7 +58,7 @@ public function verifyToken(PersistentTokenInterface $token, string $tokenValue)
     /**
      * {@inheritdoc}
      */
-    public function updateExistingToken(PersistentTokenInterface $token, string $tokenValue, \DateTimeInterface $lastUsed): void
+    public function updateExistingToken(PersistentTokenInterface $token, #[\SensitiveParameter] string $tokenValue, \DateTimeInterface $lastUsed): void
     {
         // When a token gets updated, persist the outdated token for $outdatedTokenTtl seconds so we can
         // still accept it as valid in verifyToken

Authentication/RememberMe/InMemoryTokenProvider.php

@@ -37,7 +37,7 @@ public function loadTokenBySeries(string $series): PersistentTokenInterface
     /**
      * {@inheritdoc}
      */
-    public function updateToken(string $series, string $tokenValue, \DateTime $lastUsed)
+    public function updateToken(string $series, #[\SensitiveParameter] string $tokenValue, \DateTime $lastUsed)
     {
         if (!isset($this->tokens[$series])) {
             throw new TokenNotFoundException('No token found.');

Authentication/RememberMe/PersistentToken.php

@@ -24,7 +24,7 @@ final class PersistentToken implements PersistentTokenInterface
     private string $tokenValue;
     private \DateTime $lastUsed;
 
-    public function __construct(string $class, string $userIdentifier, string $series, string $tokenValue, \DateTime $lastUsed)
+    public function __construct(string $class, string $userIdentifier, string $series, #[\SensitiveParameter] string $tokenValue, \DateTime $lastUsed)
     {
         if (empty($class)) {
             throw new \InvalidArgumentException('$class must not be empty.');

Authentication/RememberMe/TokenProviderInterface.php

@@ -39,7 +39,7 @@ public function deleteTokenBySeries(string $series);
      *
      * @throws TokenNotFoundException if the token is not found
      */
-    public function updateToken(string $series, string $tokenValue, \DateTime $lastUsed);
+    public function updateToken(string $series, #[\SensitiveParameter] string $tokenValue, \DateTime $lastUsed);
 
     /**
      * Creates a new token.

Authentication/RememberMe/TokenVerifierInterface.php

@@ -23,10 +23,10 @@ interface TokenVerifierInterface
      *
      * Do not forget to implement token comparisons using hash_equals for a secure implementation.
      */
-    public function verifyToken(PersistentTokenInterface $token, string $tokenValue): bool;
+    public function verifyToken(PersistentTokenInterface $token, #[\SensitiveParameter] string $tokenValue): bool;
 
     /**
      * Updates an existing token with a new token value and lastUsed time.
      */
-    public function updateExistingToken(PersistentTokenInterface $token, string $tokenValue, \DateTimeInterface $lastUsed): void;
+    public function updateExistingToken(PersistentTokenInterface $token, #[\SensitiveParameter] string $tokenValue, \DateTimeInterface $lastUsed): void;
 }

Authentication/Token/RememberMeToken.php

@@ -28,7 +28,7 @@ class RememberMeToken extends AbstractToken
      *
      * @throws \InvalidArgumentException
      */
-    public function __construct(UserInterface $user, string $firewallName, string $secret)
+    public function __construct(UserInterface $user, string $firewallName, #[\SensitiveParameter] string $secret)
     {
         parent::__construct($user->getRoles());
 

Signature/SignatureHasher.php

@@ -35,7 +35,7 @@ class SignatureHasher
      * @param ExpiredSignatureStorage|null $expiredSignaturesStorage if provided, secures a sequence of hashes that are expired
      * @param int|null                     $maxUses                  used together with $expiredSignatureStorage to allow a maximum usage of a hash
      */
-    public function __construct(PropertyAccessorInterface $propertyAccessor, array $signatureProperties, string $secret, ExpiredSignatureStorage $expiredSignaturesStorage = null, int $maxUses = null)
+    public function __construct(PropertyAccessorInterface $propertyAccessor, array $signatureProperties, #[\SensitiveParameter] string $secret, ExpiredSignatureStorage $expiredSignaturesStorage = null, int $maxUses = null)
     {
         $this->propertyAccessor = $propertyAccessor;
         $this->signatureProperties = $signatureProperties;