Skip to content

[Security] Auto-login after registration doesn't work with lazy firewalls. #34736

@pierredup

Description

@pierredup

Symfony version(s) affected: 4.4.0

Description
When using lazy firewalls (#33676), the $guardHandler->authenticateUserAndHandleSuccess(...) method has no effect after registering a user. When setting anonymous: true in the security config, this then works again as expected.

The only way I could get this to work, was adding the following access_control rule in the security.yaml:

    - { path: ^/register, roles: [IS_AUTHENTICATED_ANONYMOUSLY, ROLE_USER] }

I'm not sure if this is the correct way, as I could not find any documentation. The main issue is that the Flex recipe by defaults sets anonymouos: lazy, and when using the maker bundle too create the registration process, it doesn't add the access_control rules, which means auto login after registration doens't work anymore out of the box since 4.4.

So my question is, is this a bug? Is it a documentation issue that needs to be updated, or should the maker-bundle be updated to cater for this? I'll gladly send a PR to the correct repo if someone can point to me where the issue needs fixing.

How to reproduce

  • Create a new empty 4.4 project
    • $ composer create-project symfony/skeleton:^4.4 symfony && cd symfony
  • Include the required dependencies
    • $ composer req maker doctrine/annotations form validator twig-bundle orm-pack security
  • Create a basic auth & registration flow
    • $ bin/console make:user
    • $ bin/console make:auth
    • $ bin/console make:registration
  • Run a webserver, visit /register, and after registration, the user is not logged in

Possible Solution

I'm not sure if this is a documentation issue or a bug, or an update requires in the maker-bundle

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions