Merge branch '7.4' into 8.0

* 7.4: (46 commits)
  [Runtime][FrameworkBundle] Trust argv on CLI-like SAPIs in the remaining QUERY_STRING gates
  Fix tests and merge resolution after merging 6.4 into 7.4
  [FrameworkBundle] Allow to pass `doctrine_open_transaction_logger`’s entity manager name positionally
  Remove protectedHeaderOnly from claim checkers
  [String][Mime] Reject objects in typed-string properties during __unserialize
  [Cache] Fix strlen(null) deprecation on RelayCluster path in RedisTrait::doClear()
  [Scheduler] Recover pending RecurringMessages after consumer stops midway
  [SecurityBundle] Fix Security::login() across firewalls
  [Routing][RateLimiter][Mime][Security] Harden __unserialize against __toString trampolines
  [Security] Initialize lazy users before serializing them in the session
  [Process] Stop leaking CGI/FastCGI request-context vars to subprocesses
  [Runtime] Trust argv on CLI-like SAPIs to fix subprocess args
  [Mailer] Harden default IP allowlist for Postmark and Brevo webhook parsers
  [Cache] Accept '_' and ':' in prefix passed to AbstractAdapter::clear()
  [HtmlSanitizer] Honor universal attribute sanitizers, apply maxInputLength to text contexts, document forceAttribute and allowAttribute caveats
  [Mailer][Notifier] Harden Mailchimp signature comparison and Smsbox IP allowlist
  [Translation] Don’t check the error message to know if Lokalise keys are missing
  [AssetMapper] Rewrite relative paths in `export ... from` statements
  [Yaml] Allow trailing newlines after the end-of-document marker
  [HttpKernel][WebProfilerBundle] Check logs priority name for both `WARNING` and `warning`
  ...

# Conflicts:
#	CHANGELOG-8.0.md
#	src/Symfony/Component/HttpKernel/Kernel.php
#	src/Symfony/Component/Mime/Part/SMimePart.php
#	src/Symfony/Component/Mime/Part/TextPart.php
#	src/Symfony/Component/String/UnicodeString.php

Author: nicolas-grekas

DependencyInjection/SecurityExtension.php

@@ -304,7 +304,7 @@ private function createFirewalls(array $config, ContainerBuilder $container): vo
 
         // load firewall map
         $mapDef = $container->getDefinition('security.firewall.map');
-        $map = $authenticationProviders = $contextRefs = $authenticators = [];
+        $map = $authenticationProviders = $contextRefs = $authenticators = $firewallConfigRefs = [];
         foreach ($firewalls as $name => $firewall) {
             if (isset($firewall['user_checker']) && 'security.user_checker' !== $firewall['user_checker']) {
                 $customUserChecker = true;
@@ -336,13 +336,15 @@ private function createFirewalls(array $config, ContainerBuilder $container): vo
 
             $contextRefs[$contextId] = new Reference($contextId);
             $map[$contextId] = $matcher;
+            $firewallConfigRefs[$name] = new Reference($configId);
         }
         $container
             ->getDefinition('security.helper')
             ->replaceArgument(1, $authenticators)
         ;
 
         $container->setAlias('security.firewall.context_locator', (string) ServiceLocatorTagPass::register($container, $contextRefs));
+        $container->setAlias('security.firewall_config_locator', (string) ServiceLocatorTagPass::register($container, $firewallConfigRefs));
 
         $mapDef->replaceArgument(0, new Reference('security.firewall.context_locator'));
         $mapDef->replaceArgument(1, new IteratorArgument($map));

Resources/config/security.php

@@ -95,6 +95,7 @@
                     'security.user_checker_locator' => service('security.user_checker_locator'),
                     'security.firewall.event_dispatcher_locator' => service('security.firewall.event_dispatcher_locator'),
                     'security.csrf.token_manager' => service('security.csrf.token_manager')->ignoreOnInvalid(),
+                    'security.firewall_config_locator' => service('security.firewall_config_locator')->ignoreOnInvalid(),
                 ]),
                 abstract_arg('authenticators'),
             ])

Security.php

@@ -13,8 +13,10 @@
 
 use Psr\Container\ContainerInterface;
 use Symfony\Bundle\SecurityBundle\Security\FirewallConfig;
+use Symfony\Component\HttpFoundation\Exception\SessionNotFoundException;
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\HttpFoundation\Session\SessionInterface;
 use Symfony\Component\Security\Core\Authentication\Token\Storage\TokenStorageInterface;
 use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
 use Symfony\Component\Security\Core\Authorization\AccessDecision;
@@ -118,9 +120,9 @@ public function login(UserInterface $user, ?string $authenticatorName = null, ?s
             throw new LogicException('Unable to login without a request context.');
         }
 
-        $firewallName ??= $this->getFirewallConfig($request)?->getName();
+        $currentFirewallConfig = $this->getFirewallConfig($request);
 
-        if (!$firewallName) {
+        if (!$firewallName ??= $currentFirewallConfig?->getName()) {
             throw new LogicException('Unable to login as the current route is not covered by any firewall.');
         }
 
@@ -129,7 +131,59 @@ public function login(UserInterface $user, ?string $authenticatorName = null, ?s
         $userCheckerLocator = $this->container->get('security.user_checker_locator');
         $userCheckerLocator->get($firewallName)->checkPreAuth($user);
 
-        return $this->container->get('security.authenticator.managers_locator')->get($firewallName)->authenticateUser($user, $authenticator, $request, $badges, $attributes);
+        $response = $this->container->get('security.authenticator.managers_locator')->get($firewallName)->authenticateUser($user, $authenticator, $request, $badges, $attributes);
+
+        if ($currentFirewallConfig && $firewallName !== $currentFirewallConfig->getName()) {
+            $this->persistTokenInTargetFirewall($request, $firewallName);
+        }
+
+        return $response;
+    }
+
+    /**
+     * Persists the freshly minted token under the target firewall's session key
+     * and prevents the current firewall's ContextListener from overwriting its
+     * own session bucket with a token that belongs to another firewall.
+     */
+    private function persistTokenInTargetFirewall(Request $request, string $firewallName): void
+    {
+        $token = $this->container->get('security.token_storage')->getToken();
+        if (null === $token) {
+            return;
+        }
+
+        $targetConfig = $this->getNamedFirewallConfig($firewallName);
+        if (null === $targetConfig || $targetConfig->isStateless()) {
+            return;
+        }
+
+        if (null === $session = $this->getSessionForWrite($request)) {
+            return;
+        }
+
+        $session->set('_security_'.$targetConfig->getContext(), serialize($token));
+
+        $request->attributes->remove('_security_firewall_run');
+    }
+
+    private function getNamedFirewallConfig(string $firewallName): ?FirewallConfig
+    {
+        if (!$this->container->has('security.firewall_config_locator')) {
+            return null;
+        }
+
+        $locator = $this->container->get('security.firewall_config_locator');
+
+        return $locator->has($firewallName) ? $locator->get($firewallName) : null;
+    }
+
+    private function getSessionForWrite(Request $request): ?SessionInterface
+    {
+        try {
+            return $request->getSession();
+        } catch (SessionNotFoundException) {
+            return null;
+        }
     }
 
     /**

Tests/Functional/SecurityTest.php

@@ -124,6 +124,21 @@ public function testLogin(string $authenticator)
         $this->assertSame('chalasr', static::getContainer()->get('security.helper')->getUser()->getUserIdentifier());
     }
 
+    public function testLoginBetweenStatefulFirewalls()
+    {
+        $client = $this->createClient(['test_case' => 'SecurityHelper', 'root_config' => 'config.yml']);
+        $client->loginUser(new InMemoryUser('no-role-username', 'the-password'), 'main');
+
+        static::getContainer()->get(ForceLoginController::class)->firewallName = 'second';
+        $client->request('GET', '/main/force-login');
+
+        $client->request('GET', '/second/logged-in');
+        $this->assertSame(['message' => 'Welcome back @chalasr'], json_decode($client->getResponse()->getContent(), true));
+
+        $client->request('GET', '/main/logged-in');
+        $this->assertSame(['message' => 'Welcome back @no-role-username'], json_decode($client->getResponse()->getContent(), true));
+    }
+
     public function testLogout()
     {
         $client = $this->createClient(['test_case' => 'SecurityHelper', 'root_config' => 'config.yml', 'debug' => true]);
@@ -258,6 +273,7 @@ public function eraseCredentials(): void
 class ForceLoginController
 {
     public string $authenticator = 'form_login';
+    public ?string $firewallName = null;
 
     public function __construct(private Security $security)
     {
@@ -266,7 +282,7 @@ public function __construct(private Security $security)
     public function welcome()
     {
         $user = new InMemoryUser('chalasr', 'the-password', ['ROLE_FOO']);
-        $this->security->login($user, $this->authenticator);
+        $this->security->login($user, $this->authenticator, $this->firewallName);
 
         return new JsonResponse(['message' => \sprintf('Welcome @%s!', $this->security->getUser()->getUserIdentifier())]);
     }