feature symfony#56838 [Security] Deprecate argument $secret of RememberMeToken and RememberMeAuthenticator (nicolas-grekas)

This PR was merged into the 7.2 branch.

Discussion
----------

[Security] Deprecate argument $secret of RememberMeToken and RememberMeAuthenticator

| Q             | A
| ------------- | ---
| Branch?       | 7.2
| Bug fix?      | no
| New feature?  | no
| Deprecations? | yes
| Issues        | -
| License       | MIT

One less use for `kernel.secret`.
The secret is not used since the new authentication system.

Commits
-------

6909ec9 [Security] Deprecate argument $secret of RememberMeToken and RememberMeAuthenticator

Author: fabpot

UPGRADE-7.2.md

@@ -0,0 +1,14 @@
+UPGRADE FROM 7.1 to 7.2
+=======================
+
+Symfony 7.2 is a minor release. According to the Symfony release process, there should be no significant
+backward compatibility breaks. Minor backward compatibility breaks are prefixed in this document with
+`[BC BREAK]`, make sure your code is compatible with these entries before upgrading.
+Read more about this in the [Symfony documentation](https://symfony.com/doc/7.2/setup/upgrade_minor.html).
+
+If you're upgrading from a version below 7.1, follow the [7.1 upgrade guide](UPGRADE-7.1.md) first.
+
+Security
+--------
+
+ * Deprecate argument `$secret` of `RememberMeToken` and `RememberMeAuthenticator`

src/Symfony/Bundle/SecurityBundle/DependencyInjection/Security/Factory/RememberMeFactory.php

@@ -107,7 +107,7 @@ public function createAuthenticator(ContainerBuilder $container, string $firewal
         $container
             ->setDefinition($authenticatorId, new ChildDefinition('security.authenticator.remember_me'))
             ->replaceArgument(0, new Reference($rememberMeHandlerId))
-            ->replaceArgument(3, $config['name'] ?? $this->options['name'])
+            ->replaceArgument(2, $config['name'] ?? $this->options['name'])
         ;
 
         return $authenticatorId;

src/Symfony/Bundle/SecurityBundle/Resources/config/security_authenticator_remember_me.php

@@ -85,7 +85,6 @@
             ->abstract()
             ->args([
                 abstract_arg('remember me handler'),
-                param('kernel.secret'),
                 service('security.token_storage'),
                 abstract_arg('options'),
                 service('logger')->nullOnInvalid(),

src/Symfony/Bundle/SecurityBundle/composer.json

@@ -26,9 +26,9 @@
         "symfony/http-kernel": "^6.4|^7.0",
         "symfony/http-foundation": "^6.4|^7.0",
         "symfony/password-hasher": "^6.4|^7.0",
-        "symfony/security-core": "^6.4|^7.0",
+        "symfony/security-core": "^7.2",
         "symfony/security-csrf": "^6.4|^7.0",
-        "symfony/security-http": "^7.1",
+        "symfony/security-http": "^7.2",
         "symfony/service-contracts": "^2.5|^3"
     },
     "require-dev": {

src/Symfony/Component/Security/Core/Authentication/Token/RememberMeToken.php

@@ -21,28 +21,26 @@
  */
 class RememberMeToken extends AbstractToken
 {
-    private string $secret;
+    private ?string $secret = null;
     private string $firewallName;
 
     /**
-     * @param string $secret A secret used to make sure the token is created by the app and not by a malicious client
-     *
      * @throws \InvalidArgumentException
      */
-    public function __construct(UserInterface $user, string $firewallName, #[\SensitiveParameter] string $secret)
+    public function __construct(UserInterface $user, string $firewallName)
     {
         parent::__construct($user->getRoles());
 
-        if (!$secret) {
-            throw new InvalidArgumentException('A non-empty secret is required.');
+        if (\func_num_args() > 2) {
+            trigger_deprecation('symfony/security-core', '7.2', 'The "$secret" argument of "%s()" is deprecated.', __METHOD__);
+            $this->secret = func_get_arg(2);
         }
 
         if (!$firewallName) {
             throw new InvalidArgumentException('$firewallName must not be empty.');
         }
 
         $this->firewallName = $firewallName;
-        $this->secret = $secret;
 
         $this->setUser($user);
     }
@@ -52,13 +50,19 @@ public function getFirewallName(): string
         return $this->firewallName;
     }
 
+    /**
+     * @deprecated since Symfony 7.2
+     */
     public function getSecret(): string
     {
-        return $this->secret;
+        trigger_deprecation('symfony/security-core', '7.2', 'The "%s()" method is deprecated.', __METHOD__);
+
+        return $this->secret ??= base64_encode(random_bytes(8));
     }
 
     public function __serialize(): array
     {
+        // $this->firewallName should be kept at index 1 for compatibility with payloads generated before Symfony 8
         return [$this->secret, $this->firewallName, parent::__serialize()];
     }
 

src/Symfony/Component/Security/Core/CHANGELOG.md

@@ -1,6 +1,10 @@
 CHANGELOG
 =========
 
+7.2
+---
+
+ * Deprecate argument `$secret` of `RememberMeToken`
 
 7.0
 ---

src/Symfony/Component/Security/Core/Tests/Authentication/AuthenticationTrustResolverTest.php

@@ -72,7 +72,7 @@ protected function getRememberMeToken()
     {
         $user = new InMemoryUser('wouter', '', ['ROLE_USER']);
 
-        return new RememberMeToken($user, 'main', 'secret');
+        return new RememberMeToken($user, 'main');
     }
 }
 

src/Symfony/Component/Security/Core/Tests/Authentication/Token/RememberMeTokenTest.php

@@ -20,22 +20,22 @@ class RememberMeTokenTest extends TestCase
     public function testConstructor()
     {
         $user = $this->getUser();
-        $token = new RememberMeToken($user, 'fookey', 'foo');
+        $token = new RememberMeToken($user, 'fookey');
 
         $this->assertEquals('fookey', $token->getFirewallName());
-        $this->assertEquals('foo', $token->getSecret());
         $this->assertEquals(['ROLE_FOO'], $token->getRoleNames());
         $this->assertSame($user, $token->getUser());
     }
 
-    public function testConstructorSecretCannotBeEmptyString()
+    /**
+     * @group legacy
+     */
+    public function testSecret()
     {
-        $this->expectException(\InvalidArgumentException::class);
-        new RememberMeToken(
-            $this->getUser(),
-            '',
-            ''
-        );
+        $user = $this->getUser();
+        $token = new RememberMeToken($user, 'fookey', 'foo');
+
+        $this->assertEquals('foo', $token->getSecret());
     }
 
     protected function getUser($roles = ['ROLE_FOO'])

src/Symfony/Component/Security/Core/Tests/Authorization/ExpressionLanguageTest.php

@@ -50,7 +50,7 @@ public static function provider()
         $user = new InMemoryUser('username', 'password', $roles);
 
         $noToken = null;
-        $rememberMeToken = new RememberMeToken($user, 'firewall-name', 'firewall');
+        $rememberMeToken = new RememberMeToken($user, 'firewall-name');
         $usernamePasswordToken = new UsernamePasswordToken($user, 'firewall-name', $roles);
 
         return [

src/Symfony/Component/Security/Core/Tests/Authorization/Voter/AuthenticatedVoterTest.php

@@ -101,7 +101,7 @@ public function getCredentials()
         }
 
         if ('remembered' === $authenticated) {
-            return new RememberMeToken($user, 'foo', 'bar');
+            return new RememberMeToken($user, 'foo');
         }
 
         if ('impersonated' === $authenticated) {