Geek Answers Handbook

Symfony2: login does not work the first time after clearing cookies.

When I try to log in, Symfony2 tells me that I entered the wrong credentials. The second attempt works. Any ideas why this might happen? To reproduce the behavior, I have to log out, clear the cookies, go back to the login page and log back in.

I am using FOSUserBundle.

config.yml:

framework: #esi: ~ secret: asdfsadfasdf #translator: { fallback: en } charset: UTF-8 router: { resource: "%kernel.root_dir%/config/routing.yml" } form: true csrf_protection: true validation: { enable_annotations: true } templating: { engines: ['twig'], assets_version: v1.2 } #assets_version: SomeVersionScheme translator: { fallback: de } session: default_locale: de auto_start: false lifetime: 1000000 ...

security.yml:

 security: encoders: Symfony\Component\Security\Core\User\User: plaintext role_hierarchy: ROLE_ADMIN: ROLE_USER ROLE_SUPER_ADMIN: [ROLE_USER, ROLE_ADMIN, ROLE_ALLOWED_TO_SWITCH] providers: fos_userbundle: id: fos_user.user_manager firewalls: dev: pattern: ^/(_(profiler|wdt)|css|images|js)/ security: false login: pattern: ^/login$ security: false public: pattern: ^/.* form_login: provider: fos_userbundle check_path: /login_check remember_me: true remember_me: key: aaasfasdfasdfsadfsadf lifetime: 1296000 #15 days in second path: / anonymous: true logout: true access_control: - { path: ^/login, roles: IS_AUTHENTICATED_ANONYMOUSLY} - { path: ^/register, roles: IS_AUTHENTICATED_ANONYMOUSLY} #- { path: ^/_internal, roles: IS_AUTHENTICATED_ANONYMOUSLY, ip: 127.0.0.1 } - { path: ^/events/create, roles: ROLE_USER } #... acl: connection: default

routing.yml:

 _imagine: resource: . type: imagine _index: resource: "@AjadoEventHubBundle/Controller/IndexController.php" type: annotation fos_comment_api: type: rest resource: "@FOSCommentBundle/Resources/config/routing.yml" prefix: /api fos_user_security: resource: "@FOSUserBundle/Resources/config/routing/security.xml" ...

@ FOSUserBundle / Resources / configuration / routing / security.xml:

 <routes xmlns="http://symfony.com/schema/routing" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://symfony.com/schema/routing http://symfony.com/schema/routing/routing-1.0.xsd"> <route id="fos_user_security_login" pattern="/login"> <default key="_controller">FOSUserBundle:Security:login</default> </route> <route id="fos_user_security_check" pattern="/login_check"> <default key="_controller">FOSUserBundle:Security:check</default> </route> <route id="fos_user_security_logout" pattern="/logout"> <default key="_controller">FOSUserBundle:Security:logout</default> </route> </routes>
+2
source share
4 answers

In my opinion, this is the expected behavior since you have enabled anonymous authentication:

  • You request the URL of your application without registering => a session cookie is created with your session ID
  • Anonymous token created
  • You clear cookie => more session id to identify you
  • The next request, the token is not tied to your login request ...
+2
source

I am not familiar with symfony, however, I encountered the same problem when authentication looked for a valid cookie, but the cookie was created after verification, which caused it to pass a second time, never the first.

+1
source

By default, symfony requires that the session exist before the form is submitted.

from documents

 # by default, a session must exist before submitting an authentication request # if false, then Request::hasPreviousSession is not called during authentication # new in Symfony 2.3

To make this happen, you can set "require_previous_session" (true by default) to false in "security.yml" in the "form_login" section as follows: require_previous_session: false

You can learn more about this in the Symfony docs at the following SecurityBundle Configuration ("Security") link .

+1
source

I had this problem and solved it after the answer here is Symfony 2 "Your session has been disconnected or you have disabled cookies."

@AlterPHP was right, you need to log in twice because the first time you get an error like this:

Authentication request failed. (...) Your session has timed out, or you have disabled cookies.

Since you do not have a session, a new session is created with this request. The next time you try to log in, when the session was created, you can log in.

You needed to set the require_previous_session: false option in the app/config/security.yml file to avoid searching for the previous session:

 security: firewalls: main: form_login: require_previous_session: false
0
source

More articles:


All Articles