Symfony 2 UserInterface :: equals ($ user): comparison for re-authentication

Question

From class UserInterface

interface UserInterface { /** * The equality comparison should neither be done by referential equality * nor by comparing identities (ie getId() === getId()). * * However, you do not need to compare every attribute, but only those that * are relevant for assessing whether re-authentication is required. * * @param UserInterface $user * @return Boolean */ function equals(UserInterface $user); } 

How do I implement this ("those that are important for assessing the need for re-authentication")? Does this mean after Symfony 2 re-authenticated (username / password) user? Or this function should be re-checked. Is it possible to check id, username, password, salt ? Does Symfony authenticate the user with a password, which should be enough?

Answer 1

If equals() returns false , the user will be forced to authenticate again. What exactly you check is up to you, because it differs from one application to another. As a rule, you need to compare everything that can change in relation to the user, which affects the security of your application.

For example, if you use an email address and password for authentication in the application, you need to compare them. On the contrary, comparing the first and last name fields does not make sense, since they do not affect anything related to authentication in your application - unless, of course, the authentication of your application is somehow based on them.

If you support different roles in your application — for example, an administrator and a regular user — and your application provides a way to assign and reassign these roles to users, you also need to compare the roles. Because if you want to lower the user rating from administrator to regular user, you want the changes to take effect as soon as possible - at the next user request - without explicitly asking the user to log out and reinstall. If you do not compare roles in this case, the user will remain an administrator until the expiration of her session.

Verifying the identifier does not make sense if your application does not allow changing user identifiers, and they are used for authentication in your application. And I wouldn’t check the salt either, because if it changed, it also meant that the password changed too, so it’s enough to check only the password.

Answer 2

Update:

Now, the equal function has been removed from UserInterface and added to the new interface: EquatableInterface , and the function name has been changed to isEqualTo .

So, if you want to change the logic that forces the connected user to disconnect, your User class needs to implement the EquatableInterface isEqualTo interface function.

Be careful: if you do this, you will lose the standard user check, which checks the changed password, changed username, ...