[SecurityBundle] Set request stateless when firewall is stateless

[alamirault]

Q	A
Branch?	6.3
Bug fix?	no
New feature?	yes
Deprecations?	no
Tickets	Fix #40372
License	MIT
Doc PR	symfony/symfony-docs#...

Automatically add _stateless attribute to the request when firewall is stateless

[carsonbot]

Hey!

I think @TimoBakx has recently worked with this code. Maybe they can help review this?

Cheers!

Carsonbot

[chalasr]

Thanks for the PR.
As it's too late for 6.2, this PR should be rebased on the 6.3 branch (and the changelog entry be moved accordingly) once that branch is created, when 6.2.0 stable is released.

[alamirault]

I rebased on branch 6.3 😄

[stof]

This looks wrong to me. Something else than the Firewall could still be using the session.

[Seldaek]

@stof Sure, but that's why you want a warning IMO. If the firewall is stateless then you shouldn't rely on the session and opening one will most likely result in data loss or at least inefficiencies in the code as it reads from session storage for nothing.

[nicolas-grekas]

👍
Using the session on a stateless firewall looks like a mistake to me.
This allows spotting it.

[fabpot]

Thank you @alamirault.

[tucksaun]

I tend to agree with @stof here: while it's true that most stateless firewalls are used with stateless routes, this is not systematic and you can have stateless authentication (using JWT cookies or an HTTP middleware adding trusted headers to the request for example) but still require sessions for some specific pages (for CSRF tokens or flash messages for example).

I believe we should at least allow this behavior to be overridable if the current request is already marked as stateless: false.

[johannes85]

Our software falls into the case described by @tucksaun, so after updateing to 6.3 it breakes our software.

Instead of using the signin methods provided by Symfony, we load the user object from a external server with a session id cookie written by an external SSO software. For this we use a custom, stateless authenticator.

We also use Symfony sessions, but not for authetication, which triggers the "Session was used while the request was declared stateless." exception.

Is there any way to override this behavior? I found his pull request (symfony/symfony-docs#18195) but I didn't find any documentation what to change in order to get the old behavior

[tucksaun]

@johannes85 you can define the request as stateful via the routing:

#config/routes/security.yaml
app_logout:
    path: /logout
    methods: GET
    defaults:
        _stateless: false

// [...]
class DashboardController extends AbstractDashboardController
{
    #[Route('/admin', name: 'admin', stateless: false)]
    public function index(): Response
// [...]

[johannes85]

Thank you. I wasn't sure if it is that easy or if I do something "not the symfony way" which will break someting else.

[derrabus]

I've opened #50715 for further discussion.