{"action":"created","issue":{"url":"https://api.github.com/repos/symfony/symfony/issues/13287","labels_url":"https://api.github.com/repos/symfony/symfony/issues/13287/labels{/name}","comments_url":"https://api.github.com/repos/symfony/symfony/issues/13287/comments","events_url":"https://api.github.com/repos/symfony/symfony/issues/13287/events","html_url":"https://github.com/symfony/symfony/issues/13287","id":53520846,"number":13287,"title":"[Security] refreshUser() doesn't call eraseCredentials()","user":{"login":"iltar","id":1754678,"avatar_url":"https://avatars.githubusercontent.com/u/1754678?v=3","gravatar_id":"","url":"https://api.github.com/users/iltar","html_url":"https://github.com/iltar","followers_url":"https://api.github.com/users/iltar/followers","following_url":"https://api.github.com/users/iltar/following{/other_user}","gists_url":"https://api.github.com/users/iltar/gists{/gist_id}","starred_url":"https://api.github.com/users/iltar/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/iltar/subscriptions","organizations_url":"https://api.github.com/users/iltar/orgs","repos_url":"https://api.github.com/users/iltar/repos","events_url":"https://api.github.com/users/iltar/events{/privacy}","received_events_url":"https://api.github.com/users/iltar/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/symfony/symfony/labels/Security","name":"Security","color":"DDDDDD"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":4,"created_at":"2015-01-06T14:41:38Z","updated_at":"2015-05-22T04:56:56Z","closed_at":null,"body":"When checking back some code I wrote, I noticed that I didn't implement `eraseCredentials()` properly. My user always had a Password and Salt. I started to investigate and hit the following issues:\r\n\r\n - A user is always initiated with a password/salt present. \r\n - With a refresh, `eraseCredentials()` is never called.\r\n\r\nAs far as I can tell, a refresh _always_ refreshes the user and is triggered _every_ master request. According to the existing documentation and implementations in the core and FOSUserBundle, the whole user object is returned. This means it also populates the password and salt fields. I can simply fix this by calling `eraseCredentials()` manually in my `refreshUser()`, but I expect the security component to do that for me. What is the desired flow here? Is this done intentionally or a \"feature\" long forgotten?\r\n\r\nThe best location to call `$token->eraseCredentials();` would probably be here: https://github.com/symfony/symfony/blob/master/src/Symfony/Component/Security/Http/Firewall/ContextListener.php#L163-L165"},"comment":{"url":"https://api.github.com/repos/symfony/symfony/issues/comments/104509459","html_url":"https://github.com/symfony/symfony/issues/13287#issuecomment-104509459","issue_url":"https://api.github.com/repos/symfony/symfony/issues/13287","id":104509459,"user":{"login":"iltar","id":1754678,"avatar_url":"https://avatars.githubusercontent.com/u/1754678?v=3","gravatar_id":"","url":"https://api.github.com/users/iltar","html_url":"https://github.com/iltar","followers_url":"https://api.github.com/users/iltar/followers","following_url":"https://api.github.com/users/iltar/following{/other_user}","gists_url":"https://api.github.com/users/iltar/gists{/gist_id}","starred_url":"https://api.github.com/users/iltar/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/iltar/subscriptions","organizations_url":"https://api.github.com/users/iltar/orgs","repos_url":"https://api.github.com/users/iltar/repos","events_url":"https://api.github.com/users/iltar/events{/privacy}","received_events_url":"https://api.github.com/users/iltar/received_events","type":"User","site_admin":false},"created_at":"2015-05-22T04:56:55Z","updated_at":"2015-05-22T04:56:55Z","body":"I actually didn't even think of the fact that there was supposed to be a\npre authentication token and user up until your guard PR. My user object is\nused for both the pre and post, thus has a password filled in for both\ncases.\n\nOn Thu, 21 May 2015 23:40 Ryan Weaver <notifications@github.com> wrote:\n\n> @iltar <https://github.com/iltar> From what I can see, I actually\n> disagree. The point of eraseCredentials (which is originally on the\n> TokenInterface) is to erase the plan text password from the\n> unauthenticated token (remember, you always have an unauthenticated token\n> that's passed to the auth manager, then an authenticated token after that).\n> Having the encoded password and salt on the User object isn't sensitive. I\n> mean it is - e.g. don't print it out on the screen - but it's not sensitive\n> in the sense that the plain text password is sensitive.\n>\n> So from what I see - it works as designed currently.\n>\n> —\n> Reply to this email directly or view it on GitHub\n> <https://github.com/symfony/symfony/issues/13287#issuecomment-104428045>.\n>\n"}}