Merge branch '8.0' into 8.1

* 8.0:
  Allow defining security provider factories without config
  [FrameworkBundle] Bump Request/Session value resolver priority above EntityValueResolver
  [Messenger] Ensure SigningSerializer won't decode before verifying the signature
  [Security] Remove the legacy nested unserialize() call from token and exception classes
  [Yaml] Reject non-stringables when using "!!binary"
  [Messenger][Amqp] delayed quorum queues
  [Notifier] Use `hash_equals()` to compare webhook signatures for Vonage
  [Mailer] Use `hash_equals()` to compare webhook signatures for AhaSend
  [Inflector][String] Fixed singularize `traces` > `trace`
  [AssetMapper] Warn on missing bare CSS and JSON imports
  When pushing, run GHA only on "*.*" branches
  [Console] Fix signal handler scoping
  [Security] Preserve webserver base URL in HttpUtils::createRequest()

Author: nicolas-grekas

HttpUtils.php

@@ -69,9 +69,17 @@ public function createRequest(Request $request, string $path): Request
             Request::setTrustedProxies([], Request::getTrustedHeaderSet());
         }
 
+        // Trusted proxies are disabled above, so getBaseUrl() now returns only the
+        // webserver-derived portion of the base URL (e.g. an Apache "Alias /myapp …"
+        // sub-directory install). That portion must remain in the generated sub-request
+        // URI so it can re-detect its own base URL from SCRIPT_NAME/REQUEST_URI; only
+        // the trusted-proxy prefix is dropped from the URL generator's context here,
+        // otherwise it would be doubled once the sub-request is processed.
         $context = $this->urlGenerator?->getContext();
-        if ($baseUrl = $context?->getBaseUrl()) {
-            $context->setBaseUrl('');
+        $contextBaseUrl = $context?->getBaseUrl();
+        $realBaseUrl = null !== $context ? $request->getBaseUrl() : null;
+        if ($resetBaseUrl = $contextBaseUrl !== $realBaseUrl) {
+            $context->setBaseUrl($realBaseUrl);
         }
 
         try {
@@ -80,8 +88,8 @@ public function createRequest(Request $request, string $path): Request
             if ($trustedProxies) {
                 Request::setTrustedProxies($trustedProxies, Request::getTrustedHeaderSet());
             }
-            if ($baseUrl) {
-                $context->setBaseUrl($baseUrl);
+            if ($resetBaseUrl) {
+                $context->setBaseUrl($contextBaseUrl);
             }
         }
 

Tests/HttpUtilsTest.php

@@ -258,6 +258,66 @@ public function testCreateRequestFromRouteHandlesTrustedHeaders()
         );
     }
 
+    public function testCreateRequestFromRoutePreservesScriptNameBaseUrl()
+    {
+        // Sub-directory install (Apache "Alias /myapp /var/www/myapp/public" + mod_rewrite).
+        // The master request's base URL comes from SCRIPT_NAME, NOT from X-Forwarded-Prefix.
+        // The sub-request created for a `form_login.use_forward` login MUST inherit that base
+        // URL so the URL generator (re-initialized from the sub-request via
+        // RouterListener::onKernelRequest) emits form action URLs prefixed with `/myapp`.
+        $server = [
+            'REQUEST_URI' => '/myapp/',
+            'SCRIPT_NAME' => '/myapp/index.php',
+            'PHP_SELF' => '/myapp/index.php',
+            'SCRIPT_FILENAME' => '/var/www/myapp/public/index.php',
+        ];
+        $request = new Request([], [], [], [], [], $server);
+        $this->assertSame('/myapp', $request->getBaseUrl());
+
+        $urlGenerator = new UrlGenerator(
+            $routeCollection = new RouteCollection(),
+            (new RequestContext())->fromRequest($request),
+        );
+        $routeCollection->add('app_login', new Route('/login'));
+
+        $subRequest = (new HttpUtils($urlGenerator))->createRequest($request, 'app_login');
+
+        $this->assertSame('/myapp', $subRequest->getBaseUrl());
+        $this->assertSame('http://localhost/myapp/login', $subRequest->getUri());
+    }
+
+    public function testCreateRequestFromRouteBehindProxyPreservesScriptNameBaseUrl()
+    {
+        // Sub-directory install (Apache "Alias /myapp …") behind a trusted proxy adding
+        // an extra prefix: getBaseUrl() === "/proxy-prefix" + "/myapp". Only the
+        // "/proxy-prefix" part may be dropped from the generated sub-request URI; the
+        // "/myapp" part stays so the sub-request re-detects it from SCRIPT_NAME, and the
+        // proxy prefix is re-added (not doubled) once the sub-request is processed.
+        Request::setTrustedProxies(['127.0.0.1'], Request::HEADER_X_FORWARDED_PREFIX);
+
+        $server = [
+            'REQUEST_URI' => '/myapp/',
+            'SCRIPT_NAME' => '/myapp/index.php',
+            'PHP_SELF' => '/myapp/index.php',
+            'SCRIPT_FILENAME' => '/var/www/myapp/public/index.php',
+            'REMOTE_ADDR' => '127.0.0.1',
+            'HTTP_X_FORWARDED_PREFIX' => '/proxy-prefix',
+        ];
+        $request = new Request([], [], [], [], [], $server);
+        $this->assertSame('/proxy-prefix/myapp', $request->getBaseUrl());
+
+        $urlGenerator = new UrlGenerator(
+            $routeCollection = new RouteCollection(),
+            (new RequestContext())->fromRequest($request),
+        );
+        $routeCollection->add('app_login', new Route('/login'));
+
+        $subRequest = (new HttpUtils($urlGenerator))->createRequest($request, 'app_login');
+
+        $this->assertSame('/proxy-prefix/myapp', $subRequest->getBaseUrl());
+        $this->assertSame('http://localhost/proxy-prefix/myapp/login', $subRequest->getUri());
+    }
+
     public function testCheckRequestPath()
     {
         $utils = new HttpUtils($this->getUrlGenerator());