Symfony version(s) affected

5.4.19

Description

In functional tests, the KernelBrowser::loginUser() does not seem to support lazy sessions.

For example, Symfony\Bundle\FrameworkBundle\KernelBrowser::loginUser creates a session with MOCKSESSID=d3d.... The specified user is now in the token storage as expected.

Symfony\Bundle\SecurityBundle\Security\LazyFirewallContext::__invoke then sets the initializer of the token storage, which will call Symfony\Component\Security\Http\Firewall\ContextListener::authenticate when needed.

But then ContextListener::authenticate() will use a different session (e.g. MOCKSESSID=25f...) than the one created by the KernelBrowser. Therefore the context listener cannot fetch the token from the session and will overwrite the existing user set by the KernelBrowser with null. The request in ContextListener::authenticate() has the correct cookie with the expected session id (MOCKSESSID=d3d...), but somehow a different session id is used.

The test works with lazy: false, but fails with lazy: true.

How to reproduce

Security configuration:

security:
    enable_authenticator_manager: true
    firewalls:
        main:
            lazy: true

Test:

$client = self::createClient();
// create $user from somewhere ...
 
$client->loginUser($user);
$client->request('GET', '/admin'); // Route which needs authentication

Controller:

$this->denyAccessUnlessGranted('ROLE_ADMIN');

Possible Solution

No response

Additional Context

No response