Track session usage when setting the token

Author: wouterj

Core/Authentication/Token/Storage/TokenStorage.php

@@ -49,6 +49,11 @@ public function setToken(TokenInterface $token = null)
             @trigger_error(sprintf('Not implementing the "%s::getRoleNames()" method in "%s" is deprecated since Symfony 4.3.', TokenInterface::class, \get_class($token)), E_USER_DEPRECATED);
         }
 
+        if ($token) {
+            // ensure any initializer is called
+            $this->getToken();
+        }
+
         $this->initializer = null;
         $this->token = $token;
     }

Core/Authentication/Token/Storage/UsageTrackingTokenStorage.php

@@ -52,6 +52,11 @@ public function getToken(): ?TokenInterface
     public function setToken(TokenInterface $token = null): void
     {
         $this->storage->setToken($token);
+
+        if ($token && $this->enableUsageTracking) {
+            // increments the internal session usage index
+            $this->sessionLocator->get('session')->getMetadataBag();
+        }
     }
 
     public function enableUsageTracking(): void

Http/Tests/Firewall/ContextListenerTest.php

@@ -411,9 +411,9 @@ protected function runSessionOnKernelResponse($newToken, $original = null)
 
     private function handleEventWithPreviousSession($userProviders, UserInterface $user = null, RememberMeServicesInterface $rememberMeServices = null)
     {
-        $user = $user ?: new User('foo', 'bar');
+        $tokenUser = $user ?: new User('foo', 'bar');
         $session = new Session(new MockArraySessionStorage());
-        $session->set('_security_context_key', serialize(new UsernamePasswordToken($user, '', 'context_key', ['ROLE_USER'])));
+        $session->set('_security_context_key', serialize(new UsernamePasswordToken($tokenUser, '', 'context_key', ['ROLE_USER'])));
 
         $request = new Request();
         $request->setSession($session);
@@ -442,6 +442,10 @@ private function handleEventWithPreviousSession($userProviders, UserInterface $u
         $listener(new RequestEvent($this->getMockBuilder(HttpKernelInterface::class)->getMock(), $request, HttpKernelInterface::MASTER_REQUEST));
 
         if (null !== $usageIndex) {
+            if (null !== $user) {
+                ++$usageIndex;
+            }
+
             $this->assertSame($usageIndex, $session->getUsageIndex());
             $tokenStorage->getToken();
             $this->assertSame(1 + $usageIndex, $session->getUsageIndex());

Http/composer.json

@@ -17,7 +17,7 @@
     ],
     "require": {
         "php": "^7.1.3",
-        "symfony/security-core": "^4.4.7",
+        "symfony/security-core": "^4.4.8",
         "symfony/http-foundation": "^3.4.40|^4.4.7|^5.0.7",
         "symfony/http-kernel": "^4.4",
         "symfony/property-access": "^3.4|^4.0|^5.0"