Symfony version(s) affected

6.4.24

Description

In the SecurityDataCollector, the LogoutUrlGenerator is used to add a logout link to the profiler:

The problem is that LogoutUrlGenerator fetches the token from the session, which counts as a session usage. If the current route is stateless and the firewall is a regular stateful firewall, this will generate the exception: Session was used while the request was declared stateless.

This only occurs if there is a token in the session, as the SecurityDataCollector only generates the logout path if there is a token in the storage.

How to reproduce

1. Configure a regular (stateful) firewall
2. Make sure there is a token in the session (e.g. by visiting a login route)
3. Visit the stateless route

Possible Solution

No response

Additional Context

Reproducer repository: https://github.com/micheh/stateless-bug
Visit / to automatically login and then go to /stateless