[Security] JSON login is not working as expected

[javiereguiluz]

Q	A
Bug report?	yes
Feature request?	no
BC Break report?	no
RFC?	no
Symfony version	4.0.8

This was originally reported by @Guikingone in symfony/symfony-docs#9611.

---

With a code like this, the Security Layer should intercept the request and return a dedicated response along with the credentials:

But with this response, I see the following exception:

If I add return new JsonResponse(); to the method, the exception is gone.

[stof]

Well, without the firewall config, it is hard to debug it

[Guikingone]

@stof Yes, sorry, here's the security.yaml file :

security:
    encoders:
        App\Domain\Models\User:
            algorithm: bcrypt

    providers:
        db_provider:
            entity:
                class: App\Domain\Models\User

    firewalls:
        dev:
            pattern: ^/(_(profiler|wdt)|css|images|js)/
            security: false

        main:
            anonymous: ~
            provider: db_provider
            logout_on_user_change: true
            form_login:
                login_path: web_login
                check_path: web_login
                csrf_token_generator: security.csrf.token_manager
            logout:
                path: logout
                target: index
            json_login:
                check_path: api_login
                success_handler: lexik_jwt_authentication.handler.authentication_success
                failure_handler: lexik_jwt_authentication.handler.authentication_failure

Lexik has been added for JWT generation purpose.

[Oliboy50]

I don't know if it's a bug or not, but in my case, I don't have to make my own controller to make it works using LexikJWT.

I think that the only thing you have to do is to define a route such as:

api_login:
  path: /api/login

and it should work as expected using json_login

if it doesn't, then maybe there's an issue with having both form_login and json_login on the same firewall... I never tried this 🤷‍♂️

[chalasr]

The first problem is that access_control is missing in your config. If you look at your logs, you'll see Populated the TokenStorage with an anonymous Token. because you're allowing anonymous for the whole firewall.
Secondly, the LoginAction is not necessary, you should remove it and configure your api_login without defining a controller for it, it does not need a controller at all, that's caught by the security layer.
Then, you may face some issues with both form_login and json_login, but I'm not sure.

Better split your firewall into multiple ones, one for your api and one for your web app.
You should find some inspiration here https://github.com/chalasr/lexik-jwt-authentication-sandbox/blob/flex/config/packages/security.yaml.

I suggest to close here, it's a security misconfiguration.
We should keep a documentation issue opened about the json_login though, it is outdated.

[Guikingone]

@chalasr Maybe we can update the documentation about just using a route definition rather than defining a whole controller?

For the security call, I'm gonna check this tomorrow and update the issue but I think also that this issue can be closed.

[agarb7]

I have same issue. (Symfony version: 4.0.9)
But route without controller as suggested above is not available.
route.yaml:

login:
    path: /b/login

security.yaml

security:
    encoders:
        App\Entity\Person\User:
            algorithm: bcrypt
    providers:
        database_users:
            entity:
                class: App\Entity\Person\User
    firewalls:
        main:
            pattern: ^/b/
            anonymous: ~
            json_login:
                check_path: login
    access_control:
        - { path: ^/b/login, roles: IS_AUTHENTICATED_ANONYMOUSLY }

On
curl -X POST -H "Content-Type: application/json" http://site.test/b/login -d '{"username":"user","password":"pass"}'
we get an exception
Unable to find the controller for path "/b/login". The route is wrongly configured. (404 Not Found)

In the tests for JsonLogin are:

    public function testDefaultJsonLoginSuccess()
    {
        $client = $this->createClient(array('test_case' => 'JsonLogin', 'root_config' => 'config.yml'));
        $client->request('POST', '/chk', array(), array(), array('CONTENT_TYPE' => 'application/json'), '{"user": {"login": "dunglas", "password": "foo"}}');
        $response = $client->getResponse();

        $this->assertInstanceOf(JsonResponse::class, $response);
        $this->assertSame(200, $response->getStatusCode());
        $this->assertSame(array('message' => 'Welcome @dunglas!'), json_decode($response->getContent(), true));
    }

It assume message: 'Welcome @dunglas!', that produced:

/**
 * @author Kévin Dunglas <dunglas@gmail.com>
 */
class TestController
{
    public function loginCheckAction(UserInterface $user)
    {
        return new JsonResponse(array('message' => sprintf('Welcome @%s!', $user->getUsername())));
    }
}

configured in

login_check:
    path: /chk
    defaults: { _controller: JsonLoginBundle:Test:loginCheck }

    firewalls:
        main:
            logout_on_user_change: true
            pattern: ^/
            anonymous: true
            json_login:
               check_path:    /chk
               username_path: user.login
               password_path: user.password

I don't know whether it is by design, that controller must return response and documentation is wrong. Or just test for empty controller is absent, and I made a mistake in configuration.

@dunglas Please explain the situation

[chalasr]

@agarb7 json_login is stateless oriented which means no redirection on successful authentication by default (no default_target_path option at all).
You need to write either your own success/failure handlers or a controller for your login route, which will be called on successful authentication. Documentation is out of date on this point.

[er1z]

Yup, if anything goes wrong, Symfony sends response via JSON. But when is ok — you have to handle this by yourself.

And one more thing: form_login and json_login at the same entrypoint cannot be at once.

[agarb7]

@chalasr @er1z Tests in vendor/symfony/security-bundle/Tests/Functional/JsonLoginTest.php suggest

1. check_path controller existence, that return Responce object;
   or
2. custom handlers as you mentioned.

[chalasr]

Documentation has been fixed in symfony/symfony-docs#10467, closing here.