[Security/Http] Fix compat of persistent remember-me with legacy tokens

Author: nicolas-grekas

RememberMe/PersistentRememberMeHandler.php

@@ -34,7 +34,6 @@ final class PersistentRememberMeHandler extends AbstractRememberMeHandler
 {
     private $tokenProvider;
     private $tokenVerifier;
-    private $secret;
 
     public function __construct(TokenProviderInterface $tokenProvider, string $secret, UserProviderInterface $userProvider, RequestStack $requestStack, array $options, LoggerInterface $logger = null, TokenVerifierInterface $tokenVerifier = null)
     {
@@ -45,7 +44,6 @@ public function __construct(TokenProviderInterface $tokenProvider, string $secre
         }
         $this->tokenProvider = $tokenProvider;
         $this->tokenVerifier = $tokenVerifier;
-        $this->secret = $secret;
     }
 
     /**

RememberMe/RememberMeDetails.php

@@ -36,6 +36,9 @@ public function __construct(string $userFqcn, string $userIdentifier, int $expir
 
     public static function fromRawCookie(string $rawCookie): self
     {
+        if (!str_contains($rawCookie, self::COOKIE_DELIMITER)) {
+            $rawCookie = base64_decode($rawCookie);
+        }
         $cookieParts = explode(self::COOKIE_DELIMITER, $rawCookie, 4);
         if (4 !== \count($cookieParts)) {
             throw new AuthenticationException('The cookie contains invalid data.');

Tests/RememberMe/PersistentRememberMeHandlerTest.php

@@ -156,4 +156,19 @@ public function testConsumeRememberMeCookieExpired()
 
         $this->handler->consumeRememberMeCookie(new RememberMeDetails(InMemoryUser::class, 'wouter', 360, 'series1:tokenvalue'));
     }
+
+    public function testBase64EncodedTokens()
+    {
+        $this->tokenProvider->expects($this->any())
+            ->method('loadTokenBySeries')
+            ->with('series1')
+            ->willReturn(new PersistentToken(InMemoryUser::class, 'wouter', 'series1', 'tokenvalue', new \DateTime('-10 min')))
+        ;
+
+        $this->tokenProvider->expects($this->once())->method('updateToken')->with('series1');
+
+        $rememberMeDetails = new RememberMeDetails(InMemoryUser::class, 'wouter', 360, 'series1:tokenvalue');
+        $rememberMeDetails = RememberMeDetails::fromRawCookie(base64_encode($rememberMeDetails->toString()));
+        $this->handler->consumeRememberMeCookie($rememberMeDetails);
+    }
 }