symfony/security-bundle v8.2.0-BETA1

on PHP Packagist

Changelog (v8.1.11...v8.2.0-BETA1)

• feature #67803 Hash the presented password when the user is unknown, disabled or has no password (@nicolas-grekas)
• bug #67808 Fix ldap_users_only when a firewall uses several LDAP authenticators (@nicolas-grekas)
• minor #67687 Prepare oidc_login for a future oauth2_login (@welcoMattic)
• bug #67723 Do not request a re-authentication that cannot prove a recent authentication (@BenMacha)
• bug #67667 Let target_route apply to impersonation URLs built for a switch_user path (@kbond)
• bug #67549 Make the resource of resource_metadata work across environments (@nicolas-grekas)
• bug #67544 Add a text/plain body to the 401 and 403 responses of access_token firewalls (@nicolas-grekas)
• bug #67545 Serve the protected resource metadata with Access-Control-Allow-Origin: * (@nicolas-grekas)
• minor #67316 Add command.invocation and migrate command examples (@nicolas-grekas)
• feature #67382 Add the discovery_uri option to the oidc_login authenticator (@Spomky)
• minor #67182 Remove the channel listener when no access control rule requires a channel (@nicolas-grekas)
• minor #67185 Make the OIDC services of oidc_login lazy (@nicolas-grekas)
• minor #67154 Make the built-in access token handlers lazy (@nicolas-grekas)
• feature #67140 Add the entry_point_path firewall option (@bigboss86)
• feature #67041 Retain the referer after failed authentication (@nicolas-grekas)
• feature #66999 Start a re-authentication for remember-me users when a vote asks for it (@nicolas-grekas)
• feature #66896 Ignore cookies set for another domain and don't send host-only cookies to subdomains (@X-Coder264)
• minor #66893 Resolve the env vars of framework.test when the container is compiled (@nicolas-grekas)
• minor #66878 Default the issuers of the oidc token handler and the authorization_servers of resource_metadata (@nicolas-grekas)
• feature #66882 Lower password hashing costs and disable not_compromised_password when framework.test is enabled (@nicolas-grekas)
• feature #66881 Add security.route_loader to load the routes of all firewalls (@nicolas-grekas)
• minor #66852 Cache the OIDC discovery in cache.security.discovery by default (@nicolas-grekas)
• feature #66786 Add logout_button(), impersonation_button() and impersonation_exit_button() (@nicolas-grekas)
• minor #66844 Use dedicated cache pools instead of cache.app (@nicolas-grekas)
• minor #66843 Clear the cache pools that hold runtime state at the end of each test (@nicolas-grekas)
• minor #66809 Make login links and signed remember-me cookies follow the clock (@nicolas-grekas)
• feature #66805 Make KernelBrowser::loginUser() work on stateless access_token firewalls (@nicolas-grekas)
• feature #66749 Add the mermaid format to debug:roles and deprecate debug:security:role-hierarchy (@nicolas-grekas)
• minor #66754 Allow setting re_authentication_entry_point to an authenticator key (@nicolas-grekas)
• feature #66691 Add the lint:expressions command (@nicolas-grekas)
• feature #66718 Order firewall listeners with before/after constraints (@nicolas-grekas)
• minor #66713 Declare the value resolvers that must run before EntityValueResolver (@nicolas-grekas)
• feature #66664 Deprecate ExpressionCacheWarmer and fail the warmup on invalid listed expressions instead (@nicolas-grekas)
• feature #66630 Add ConstantFunctionProvider and deprecate the unrestricted constant() and enum() (@nicolas-grekas)
• feature #66652 Compile expressions when warming up the cache (@nicolas-grekas)
• feature #66634 Allow # to vote on # arguments (@nicolas-grekas)
• feature #65628 Dispatch RateLimitExceededEvent from LoginThrottlingListener (@mariecharles)
• feature #66619 Make the OIDC client of an oidc_login firewall autowirable (@nicolas-grekas)
• feature #66196 Back-Channel Logout for oidc_login (@Spomky)
• feature #66465 Accept a DPoP-bound access token only from a request that proves its key (@Spomky)
• feature #66239 Bind what an OIDC provider issues to a key the client holds (DPoP) (@Spomky)
• feature #66238 Authenticate the OIDC client with its TLS certificate, per RFC 8705 (@Spomky)
• feature #66234 Name the issuer as the audience of an OIDC client assertion (@Spomky)
• feature #66240 Add within and around constraints to order decorators (@nicolas-grekas)
• feature #66568 Deprecate autowiring aliases named after implementations (@nicolas-grekas)
• minor #66566 Improve the hints shown by debug:autowiring (@nicolas-grekas)
• feature #66506 Allow rotating the secrets that sign URIs, remember-me cookies, login links and messages (@nicolas-grekas)
• feature #66495 Make FormLoginAuthenticator a re-authentication entry point (@kbond)
• feature #66437 Let the discovery endpoints of the oidc token handler be pinned to their issuer (@thomas-chauchefoin-tob)
• bug #66194 Fix the role hierarchy diagram in the profiler (@javiereguiluz)
• minor #66371 Move the static work of SecurityDataCollector to lateCollect() (@nicolas-grekas)
• minor #66336 Skip registering the web-token algorithms when the library is not installed (@nicolas-grekas)
• minor #66304 Make the expression language and the handlers of authenticators lazy (@nicolas-grekas)
• minor #66209 Make the config trees independent from runtime state (@nicolas-grekas)
• minor #66180 Require FrameworkBundle 8.2 for controller expression tests (@prateekbhujel)
• feature #66176 Register the security expression functions on the controller expression language (@tomsommer)
• feature #66136 Run a user checker when the user is refreshed from the session (@kbond)
• feature #66133 Add ListenerIntrospectionInterface (@nicolas-grekas)
• feature #66129 Deprecate mutating the event dispatcher of the container at runtime (@nicolas-grekas)
• minor #66119 Stop mutating the event dispatcher at runtime (@nicolas-grekas)
• feature #66069 Add AuthenticationMethodBadge, for an authenticator to state which methods it verified (@nicolas-grekas)
• feature #66066 Add IS_AUTHENTICATED_VERY_RECENTLY, decided by the trust resolver (@nicolas-grekas)
• feature #66065 Record which authentication methods were proven, and when (@nicolas-grekas)
• feature #66117 Add CheckRefreshedUserEvent to extend the user-change checks (@kbond)
• feature #66047 Allow tailoring the OIDC authorization request per request (@yceruto)
• feature #66016 Add a re-authentication entry point (@nicolas-grekas)
• feature #66035 Decide IS_AUTHENTICATED_RECENTLY through the trust resolver (@nicolas-grekas)
• minor #66050 Remove inert "extended-type" tag attributes (@nicolas-grekas)
• feature #66014 Add IS_AUTHENTICATED_RECENTLY to require a fresh authentication (@nicolas-grekas)
• feature #65916 Add the private_key_jwt and client_secret_jwt client authentication methods (@Spomky)
• feature #65981 Add the "container.remove_if_missing" tag (@nicolas-grekas)
• feature #65948 Move every configuration section to a bundle shipped by its own component (@nicolas-grekas)
• bug #65971 Improve OIDC secure URL checks (@jvasseur)
• minor #65954 Add RouterBundle (@nicolas-grekas)
• feature #65915 Let the oidc token handler answer for several audiences (@Spomky)
• feature #65910 Add an "http_client" option to the "oidc_login" authenticator (@Spomky)
• feature #65895 Inject the OAuth2 client authentication into the OIDC client (@Spomky)
• feature #65897 Read the introspection signature keys from the authorization server metadata (@nicolas-grekas)
• minor #65896 Default the access token signature algorithms to RS256 (@nicolas-grekas)
• feature #65866 Add RFC 9701 signed introspection responses (@Spomky)
• feature #65865 Make the OAuth2 introspection token handler usable (@Spomky)
• feature #65874 Require OAuth2 scopes on resources protected by an access token (@Spomky)
• feature #65864 Serve the RFC 9728 protected resource metadata of an access_token firewall (@Spomky)
• feature #65875 Renew the OIDC access token with the refresh token grant (@Spomky)
• bug #65871 Keep the "at+jwt" type check off by default in OidcTokenHandler (@Spomky)
• feature #65862 Check the RFC 9068 "at+jwt" type of OIDC access tokens (@Spomky)
• feature #65821 Add a current_user() function to the expression language provider (@seb-jean)
• feature #65839 Tell why an authenticator did not support the request in the profiler (@nicolas-grekas)
• feature #61938 Allow AuthorizationChecker::isGrantedForUser to check for guest permissions (@aschempp)
• feature #65817 Add OIDC claims source, user-identifier mapping and RP-Initiated Logout (@welcoMattic)
• feature #65814 Add OIDC PKCE, max_age, authorization-request and start-route options (@welcoMattic)
• minor #65813 Require the OIDC ID token signature verification for public clients (@welcoMattic)
• feature #65798 Verify the OIDC ID token signature against the provider JWKS (@welcoMattic)
• minor #65800 Always register the OIDC login callback route loader (@welcoMattic)
• feature #65799 Add OIDC token-endpoint client authentication methods (@welcoMattic)
• feature #65794 Use the POST_VALIDATE event in PasswordHasherExtension (@Seb33300)
• feature #64954 Add an OIDC Authorization Code Flow authenticator (@welcoMattic)
• feature #64271 Allow passing extra signed parameters in the login link URL (@janklan)
• feature #64876 Add a way to append multiple nodes via a callback (@HypeMC, @nicolas-grekas)
• feature #63112 Add a firewall option to route definitions (@tilaven)
• feature #65345 Add a debug:roles command to inspect the role hierarchy (@squrious)
• feature #61786 add role hierarchy graph to profiler security panel (@damienfern)
• feature #65279 Support decorating custom authentication result handlers (@nicolas-grekas)
• feature #65056 Deprecate access control rules voting on many attributes (@MatTheCat)
• feature #64879 Add path and CSRF options to switch_user (@kbond)
• minor #61899 Use Firewall as default tab in the WebProfiler when no token is set (@PierreCapel)
• feature #65129 Add a form helper for the logout (@nicolas-grekas)
• feature #65124 Serve the CSRF token id of a firewall through the manager it configures (@nicolas-grekas)
• feature #63867 Improve authentication debugging in the profiler (@Amoifr)
• feature #64976 Add an option to check only LDAP users against the LDAP server (@nicolas-grekas)
• feature #64875 Deprecate the unused remember_me authenticator option (@kbond)
• feature #46320 Allow disabling redirect on logout (@jvasseur)
• feature #64632 Make OidcTokenHandler allowedTimeDrift configurable (@jprivet-dev)