Feature #45282: Support for "sessionless authentication" - TYPO3.Flow - TYPO3 Forge

TYPO3 Flow Base Distribution TYPO3.Eel TYPO3.Flow TYPO3.Fluid TYPO3.Kickstart TYPO3.Welcome Packages Applications

Feature #45282

Work Package #45088: Improved REST support

Support for "sessionless authentication"

Added by Bastian Waidelich over 2 years ago. Updated about 2 years ago.

Status:

Resolved

Start date:

2013-02-08

Priority:

Should have

Due date:

2013-04-13

Assigned To:

Bastian Waidelich

% Done:

100%

Category:

Security

Target version:

TYPO3 Flow Base Distribution - 2.1

Estimated time:

108.00 hours

PHP Version:

Complexity:

Has patch:

Description

Currently Flow relies on a session to be active in at least three places:

\TYPO3\Flow\Security\Aspect\RequestDispatchingAspect::blockIllegalRequestsAndForwardToAuthenticationEntryPoints() calls \TYPO3\Flow\Security\Context::setInterceptedRequest() if an entryPoint is defined. Setting the intercepted request starts a session. This can be worked around by avoiding entryPoint or using requestPatterns to limit them only to certain parts of an application that allow sessions. #45100 might also be a solution for that
\TYPO3\Flow\Security\Authentication\AuthenticationProviderManager::authenticate() emits the authenticatedToken signal after successful authentication which is configured to call \TYPO3\Flow\Session\SessionInterface::renewId()
\TYPO3\Flow\Security\Authentication\AuthenticationProviderManager::isAuthenticated() returns FALSE if no session was started/can be resumed

Related issues

Associated revisions

Revision 7d79b800
Added by Bastian Waidelich over 2 years ago

[!!!][FEATURE] Support for "sessionless authentication"

This feature enables authentication without the need of a session to be started.
This is useful for stateless services (e.g. REST) where you don't want Flow to create
a session cookie.

This is a breaking change if you created a custom authentication provider or -token
and relied on the fact that AuthenticationProvider::authenticate() started a session.
With this change the session is started when AuthenticationToken::updateCredentials() is
called. This way the token can decide if it needs a session.
Just add a @Flow\Session(autoStart=true) to the updateCredentials() method if your custom
token relies on a session.

Change-Id: I5f86cb7a3a3fff3220d61d705f216e1b1d4f2369
Resolves: #45282
Releases: master, 2.0

Revision bd46c612
Added by Bastian Waidelich over 2 years ago

[BUGFIX] Fix security related functional tests

With the fix related to "sessionless authentication"
(I5f86cb7a3a3fff3220d61d705f216e1b1d4f2369) settings have been
adjusted in order to use the testing provider & token only for requests
matching a ControllerObjectName of "TYPO3\Flow\Tests\.*".

This change adjusts the tests accordingly.

Change-Id: I307cd295c43c346f18acc5c1fd2886166c10cbbb
Related: #45282
Resolves: #45953
Releases: master, 2.0

Revision 158f3519
Added by Bastian Waidelich over 2 years ago

[!!!][FEATURE] Support for "sessionless authentication"

This feature enables authentication without the need of a session to be started.
This is useful for stateless services (e.g. REST) where you don't want Flow to create
a session cookie.

Change-Id: I5f86cb7a3a3fff3220d61d705f216e1b1d4f2369
Resolves: #45282
Releases: master, 2.0

Revision 6a94328f
Added by Bastian Waidelich over 2 years ago

[BUGFIX] Fix security related functional tests

This change adjusts the tests accordingly.

Change-Id: I307cd295c43c346f18acc5c1fd2886166c10cbbb
Related: #45282
Resolves: #45953
Releases: master, 2.0

Revision 9feb5902
Added by Robert Lemke over 2 years ago

[FEATURE] Support for sessionless authentication

This feature enables authentication without the need of a session to
be started. This is useful for stateless services (e.g. REST) where
you don't want Flow to create a session cookie.

Authentication tokens which don't rely on a session simply implement
the SessionlessTokenInterface marker interface.

This patch reverts parts of the first implementation of sessionless
authentication introduced in https://review.typo3.org/#/c/18388
(commit I5f86cb7a3a3fff3220d61d705f216e1b1d4f2369).
The original implementation was a breaking change with a few
unresolved side effects.

The implementation contained in this change set is backwards
compatible with already existing authentication tokens which
relied on sessions.

This patch also contains a small speed optimization for the CSRF
Protection pattern which assumes that no account has been
authenticated yet if the Authentication Manager is still a Dependency
Proxy.