Note that there are some explanatory texts on larger screens.

plurals
  1. PO
    primarykey
    data
    text
    <p>Heh, this took some time to track down. :-p</p> <p>Quick answer: Due to line 92 of <a href="https://github.com/symfony/symfony/commit/46b1b5bd60432ba07bde2732a2310a5e76f94174" rel="nofollow">this</a> commit, logout handlers aren't called (and thus, the REMEMBERME cookie isn't removed) unless there's a token in the securityContext (i.e. the user is logged in).</p> <p>Longer answer: <a href="https://github.com/symfony/symfony/blame/master/src/Symfony/Component/Security/Http/RememberMe/AbstractRememberMeServices.php" rel="nofollow"><code>AbstractRememberMeServices</code></a>'s <code>cancelCookie</code> method handles the removal of the REMEMBERME token. <a href="https://github.com/symfony/symfony/blame/master/src/Symfony/Bundle/SecurityBundle/DependencyInjection/Security/Factory/RememberMeFactory.php" rel="nofollow"><code>RememberMeFactory</code></a> makes sure an implementation of this abstract class is registered with the <code>LogoutListener</code> (through some convoluted service lookups involving one of the <code>security.authentication.rememberme.services.*</code> services).</p> <p><code>LogoutListener</code> (one of <code>Firewall</code>'s listeners) is supposed to iterate through all its handlers (that implement <code>LogoutHandlerInterface</code>), calling their <code>logout</code> method. You're probably using <code>PersistentTokenBasedRememberMeServices</code>, whose service id is <code>security.authentication.rememberme.services.persistent</code> and whose <code>logout</code> method calls the <code>cancelCookie</code> method mentioned above, thus supposedly removing the REMEMBERME cookie.</p> <p>But due to the what I explained above, it is never called for users who aren't logged in (due to the session having expired). Instead, the logoutSuccessHandler redirects you, and in the following request the remaining REMEMBERME cookie kicks into action.</p> <hr> <p>I'm not sure whether this should be considered a bug (unintended side-effect of the commit) or not. Perhaps one of us should <a href="http://symfony.com/doc/current/contributing/code/bugs.html" rel="nofollow">submit it</a> and see what the devs make of it?</p> <p>:-)</p>
    singulars
    1. This table or related slice is empty.
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. VO
      singulars
      1. This table or related slice is empty.
    2. VO
      singulars
      1. This table or related slice is empty.
    1. This table or related slice is empty.
 

Querying!

 
Guidance

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload