[Security] [RFC] Update Events to retrieve the *real* Authenticator in local env (CheckPassportEvent for instance) #49010
Description
Description
In local development, doing this will not return the real authenticator used but the TraceableAuthenticator instead if you use the profiler:
#[AsEventListener(event: CheckPassportEvent::class)]
public function onCheckPassport(CheckPassportEvent $checkPassportEvent): void
{
$authenticator = $checkPassportEvent->getAuthenticator(); // TraceableAuthenticator
}To get the real authenticator, you need to retrieve the nested one:
#[AsEventListener(event: CheckPassportEvent::class)]
public function onCheckPassport(CheckPassportEvent $checkPassportEvent): void
{
$authenticator = $checkPassportEvent->getAuthenticator(); //TraceableAuthenticator
$realAuthenticator = $authenticator instanceof TraceableAuthenticator ?
$authenticator->getAuthenticator() : // FormLoginAuthenticator
$authenticator;
}I would like to include the ternary inside the event class, as well as in the other Events having this method:
- CheckPassportEvent.php
- InteractiveLoginEvent.php
- LoginFailureEvent.php
- LoginSuccessEvent.php
I'm pinging @wouterj for the idea, I can make a PR if it's something worth it 🙂
Example
If this is accepted you will be able to call ->getAuthenticator() in a more uniform way.
#[AsEventListener(event: CheckPassportEvent::class)]
public function onCheckPassport(CheckPassportEvent $checkPassportEvent): void
{
$authenticator = $checkPassportEvent->getAuthenticator(); // FormLoginAuthenticator event in dev environment
}This is a simple version of possible PR:
https://github.com/symfony/symfony/compare/6.3...florentdestremau:symfony:feature/event-authenticator?expand=1
Questions:
- should this replace the existing
getAuthenticator? - should I create instead a
getRealAuthenticatormethod to allow the existing method to return the TraceableAuthenticator?