merged branch jmikola/logout-csrf (PR #3007)

Commits
-------

49a8654 [Security] Use LogoutException for invalid CSRF token in LogoutListener
a96105e [SecurityBundle] Use assertCount() in tests
4837407 [SecurityBundle] Fix execution of functional tests with different names
66722b3 [SecurityBundle] Templating helpers to generate logout URL's with CSRF tokens
aaaa040 [Security] Allow LogoutListener to validate CSRF tokens
b1f545b [Security] Refactor LogoutListener constructor to take options
c48c775 [SecurityBundle] Add functional test for form login with CSRF token

Discussion
----------

[Security] Implement support for CSRF tokens in logout URL's

```
Bug fix: no
Feature addition: yes
Backwards compatibility break: no
Symfony2 tests pass: yes
Fixes the following tickets: -
Todo: -
```

[![Build Status](https://secure.travis-ci.org/jmikola/symfony.png?branch=logout-csrf)](http://travis-ci.org/jmikola/symfony)

This derived from #3006 but properly targeting on the master branch.

This exposes new configuration options to the logout listener to enable CSRF protection, as already exists for the form login listener. The individual commits and their extended messages should suffice for explaining the logical changes of the PR.

In addition to changing LogoutListener, I also created a templating helper to generate logout URL's, which includes a CSRF token if necessary. This may or may not using routing, depending on how the listener is configured since both route names or hard-coded paths are valid options.

Additionally, I added unit tests for LogoutListener and functional tests for both CSRF-enabled form logins and the new logout listener work.

Kudo's to @henrikbjorn for taking the time to document CSRF validation for form login listeners (see [here](http://henrik.bjrnskov.dk/symfony2-cross-site-request-forgery/)). The [Logout CSRF Protection](http://www.yiiframework.com/wiki/190/logout-csrf-protection/) article on the Yii Framework wiki was also helpful in drafting this.

---------------------------------------------------------------------------

by jmikola at 2011-12-31T07:50:31Z

Odd that Travis CI reported a build failure for PHP 5.3.2, but both 5.3 and 5.4 passed: http://travis-ci.org/#!/jmikola/symfony/builds/463356

My local machine passes as well.

---------------------------------------------------------------------------

by jmikola at 2012-02-06T20:05:30Z

@schmittjoh: Please let me know your thoughts on the last commit. I think it would be overkill to add support for another handler service and/or error page just for logout exceptions.

Perhaps as an alternative, we might just want to consider an invalid CSRF token on logout imply a false return value for `LogoutListener::requiresLogout()`. That would sacrifice the ability to handle the error separately (which a 403 response allows us), although we could still add logging (currently done in ExceptionListener).

---------------------------------------------------------------------------

by jmikola at 2012-02-13T17:41:33Z

@schmittjoh: ping

---------------------------------------------------------------------------

by fabpot at 2012-02-14T23:36:22Z

@jmikola: Instead of merging symfony/master, can you rebase?

---------------------------------------------------------------------------

by jmikola at 2012-02-15T00:00:49Z

Will do.

---------------------------------------------------------------------------

by jmikola at 2012-02-15T00:05:48Z

```
[avocado: symfony] logout-csrf (+9/-216) $ git rebase master
First, rewinding head to replay your work on top of it...
Applying: [SecurityBundle] Add functional test for form login with CSRF token
Applying: [Security] Refactor LogoutListener constructor to take options
Applying: [Security] Allow LogoutListener to validate CSRF tokens
Applying: [SecurityBundle] Templating helpers to generate logout URL's with CSRF tokens
Applying: [SecurityBundle] Fix execution of functional tests with different names
Applying: [SecurityBundle] Use assertCount() in tests
Using index info to reconstruct a base tree...
Falling back to patching base and 3-way merge...
Applying: [Security] Use LogoutException for invalid CSRF token in LogoutListener

[avocado: symfony] logout-csrf (+7) $ git st
# On branch logout-csrf
# Your branch and 'origin/logout-csrf' have diverged,
# and have 223 and 9 different commit(s) each, respectively.
#
nothing to commit (working directory clean)

[avocado: symfony] logout-csrf (+7) $
```

After rebasing, my merge commits disappeared. Is this normal?

---------------------------------------------------------------------------

by stof at 2012-02-15T00:15:07Z

Are you sure they disappeared ? Diverging from the remote branch is logical (you rewrote the history and so changed the commit id) but are you sure it does not have the commits on top of master ? Try ``git log master..logout-scrf``

If your commut are there, you simply need to force the push for the logout-csrf branch (take care to push only this branch during the force push to avoid messing all others as git won't warn you when asking to force)

---------------------------------------------------------------------------

by stof at 2012-02-15T00:17:09Z

ah sorry, you talked only about the merge commit. Yeah it is normal. When reapplying your commits on top of master, the merge commit are not kept as you are reapplying the changes linearly on top of the other branch (and deleting the merge commit was the reason why @fabpot asked you to rebase instead of merging btw)

---------------------------------------------------------------------------

by jmikola at 2012-02-15T00:18:00Z

The merge commits are not present in `git log master..logout-csrf`. Perhaps it used those merge commits when rebasing, as there were definitely conflicts resolved when I originally merged in symfony/master (@fabpot had made his own changes to LogoutListener).

I'll force-push the changes to my PR brange. IIRC, GitHub is smart enough to preserve inline diff comments, provided they were made through the PR and not on the original commits.

---------------------------------------------------------------------------

by jmikola at 2012-02-15T00:19:38Z

That worked well. In the future, I think I'll stick to merging upstream in and then rebasing afterwards. Resolving conflicts is much easier during a merge than interactive rebase.

---------------------------------------------------------------------------

by jmikola at 2012-02-23T18:46:13Z

@fabpot @schmittjoh: Is there anything else I can do for this PR? I believe the exception was the only outstanding question (see: [this comment](https://github.com/symfony/symfony/pull/3007#issuecomment-3835716)).
This should be 3 not 4, otherwiser I get the following error:

OutOfBoundsException: The index "4" is not in the range [0, 3].
[SecurityBundle] Avoid direct request dependency in LogoutUrlHelper

This quickly addresses the problem when the helper is constructed in a console environment without request scope. Ideally, the helper should be able to construct the absolute logout URL using data already available in the UrlGenerator's RequestContext and the $_SERVER environment variable; however, that will require copying some code from the Request class to create a base URI and path.

Fixes #3508
[Security]replaced acl:init command with postGenerateSchema listener
[SecurityBundle] Improve the init:acl command
fixed CS
[SecurityBundle] Lazily load the post schema listener
[FrameworkBundle + WebProfilerBundle] Optimized images and icons with PunnyPNG
[SecurityBundle] Allow switching to the user that is already impersonated (fix #2554)

Disabled exception when switching to the user that is already impersonated, exception is now only thrown when trying to switch to a new user.

Added an Excption exception when switching fails because target user does not exist.

Added funtional tests for switching users.
changed test config
merged branch meandmymonkey/switchuser-noexception (PR #3580)

Commits
-------

0e4f789 changed test config
a98d554 [SecurityBundle] Allow switching to the user that is already impersonated (fix #2554)

Discussion
----------

[Security] Disabled exception when switching to the user that is already impersonated

Bug fix: yes-ish
Feature addition: no
Backwards compatibility break: no
Symfony2 tests pass: yes
Fixes the following tickets: #2554
Todo: -

---------------------------------------------------------------------------

by vicb at 2012-03-13T14:31:45Z

@meandmymonkey thank you for your work on this issue. Would you have time to add functional tests ?

---------------------------------------------------------------------------

by meandmymonkey at 2012-03-13T14:49:52Z

Probably not today, but during the next few days, yes, of course.

---------------------------------------------------------------------------

by meandmymonkey at 2012-03-14T18:05:19Z

@vicb @schmittjoh Writing the tests I noticed switching to an non-existent user will not raise an exception. While it's not a security issue, it should raise an error for completeness sake, shouldn't it?

---------------------------------------------------------------------------

by vicb at 2012-03-14T20:28:52Z

I think it should (throw an `AuthenticationCredentialsNotFoundException`). _btw there is an extra `sprintf` in the original code that could be remove when attempting to exit_

---------------------------------------------------------------------------

by meandmymonkey at 2012-03-14T21:13:16Z

The problem with throwing an  `AuthenticationCredentialsNotFoundException` (or any other security exception for that matter) is that it derives from `AuthenticationException`, which means it gets caught by the framework and redirects to the login form, which is not what we want in this case.

We need to throw something 500-ish at [L89](https://github.com/meandmymonkey/symfony/blob/d40b3376ec657deadb983228e4e12c12f446d580/src/Symfony/Component/Security/Http/Firewall/SwitchUserListener.php#L89), either a generic or a (new) custom Exception.

---------------------------------------------------------------------------

by meandmymonkey at 2012-03-14T21:43:57Z

IMHO a `LogicException`would be fine, like the one used at [L117](https://github.com/meandmymonkey/symfony/blob/d40b3376ec657deadb983228e4e12c12f446d580/src/Symfony/Component/Security/Http/Firewall/SwitchUserListener.php#L117), as the error is not really about a failed authentication.

---------------------------------------------------------------------------

by vicb at 2012-03-14T21:49:04Z

I agree and btw very good job on the tests !

---------------------------------------------------------------------------

by meandmymonkey at 2012-03-14T22:12:43Z

Thanks :)

---------------------------------------------------------------------------

by vicb at 2012-03-15T08:01:13Z

Could you squash the commits, prefix the commit message with `[SecurityBundle]` and add `(fix #2554)` at the end ?

---------------------------------------------------------------------------

by meandmymonkey at 2012-03-15T08:53:12Z

Done.

---------------------------------------------------------------------------

by vicb at 2012-03-15T09:19:09Z

@fabpot this PR looks good to me.

---------------------------------------------------------------------------

by fabpot at 2012-03-15T12:50:50Z

Tests do not pass when you run them all.

---------------------------------------------------------------------------

by meandmymonkey at 2012-03-15T13:41:45Z

@fabpot @vicb With this config change, they pass when run together.

What is weird though is that the reason seems to be that the config for the profiler gets overwritten when running all tests together, while being used correctly when run alone. Any idea what can cause this? They should be isolated from each other.

The new config from 0e4f789 works, but enables the profiler for all SecurityBundle Tests... which is not strictly necessary.
fixed CS