1 files changed, 153 insertions, 0 deletions
diff --git a/Http/RememberMe/TokenBasedRememberMeServices.php b/Http/RememberMe/TokenBasedRememberMeServices.php
new file mode 100644
index 0000000..da5479d
--- /dev/null
+++ b/Http/RememberMe/TokenBasedRememberMeServices.php
@@ -0,0 +1,153 @@
+<?php
+
+namespace Symfony\Component\Security\Http\RememberMe;
+
+use Symfony\Component\HttpFoundation\Cookie;
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
+use Symfony\Component\Security\Core\Authentication\Token\RememberMeToken;
+use Symfony\Component\Security\Core\Exception\AuthenticationException;
+use Symfony\Component\Security\Core\User\AccountInterface;
+
+/*
+ * This file is part of the Symfony package.
+ *
+ * (c) Fabien Potencier <fabien.potencier@symfony-project.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+/**
+ * Concrete implementation of the RememberMeServicesInterface providing
+ * remember-me capabilities without requiring a TokenProvider.
+ *
+ * @author Johannes M. Schmitt <schmittjoh@gmail.com>
+ */
+class TokenBasedRememberMeServices extends RememberMeServices
+{
+    /**
+     * {@inheritDoc}
+     */
+    protected function processAutoLoginCookie(array $cookieParts, Request $request)
+    {
+        if (count($cookieParts) !== 4) {
+            throw new AuthenticationException('The cookie is invalid.');
+        }
+
+        list($class, $username, $expires, $hash) = $cookieParts;
+        if (false === $username = base64_decode($username, true)) {
+            throw new AuthenticationException('$username contains a character from outside the base64 alphabet.');
+        }
+        try {
+            $user = $this->getUserProvider($class)->loadUserByUsername($username);
+        } catch (\Exception $ex) {
+            if (!$ex instanceof AuthenticationException) {
+                $ex = new AuthenticationException($ex->getMessage(), null, $ex->getCode(), $ex);
+            }
+
+            throw $ex;
+        }
+
+        if (!$user instanceof AccountInterface) {
+            throw new \RuntimeException(sprintf('The UserProviderInterface implementation must return an instance of AccountInterface, but returned "%s".', get_class($user)));
+        }
+
+        if (true !== $this->compareHashes($hash, $this->generateCookieHash($class, $username, $expires, $user->getPassword()))) {
+            throw new AuthenticationException('The cookie\'s hash is invalid.');
+        }
+
+        if ($expires < time()) {
+            throw new AuthenticationException('The cookie has expired.');
+        }
+
+        return new RememberMeToken($user, $this->providerKey, $this->key);
+    }
+
+    /**
+     * Compares two hashes using a constant-time algorithm to avoid (remote)
+     * timing attacks.
+     *
+     * This is the same implementation as used in the BasePasswordEncoder.
+     *
+     * @param string $hash1 The first hash
+     * @param string $hash2 The second hash
+     *
+     * @return Boolean true if the two hashes are the same, false otherwise
+     */
+    protected function compareHashes($hash1, $hash2)
+    {
+        if (strlen($hash1) !== $c = strlen($hash2)) {
+            return false;
+        }
+
+        $result = 0;
+        for ($i = 0; $i < $c; $i++) {
+            $result |= ord($hash1[$i]) ^ ord($hash2[$i]);
+        }
+
+        return 0 === $result;
+    }
+
+    /**
+     * {@inheritDoc}
+     */
+    protected function onLoginSuccess(Request $request, Response $response, TokenInterface $token)
+    {
+        if ($token instanceof RememberMeToken) {
+            return;
+        }
+
+        $user = $token->getUser();
+        $expires = time() + $this->options['lifetime'];
+        $value = $this->generateCookieValue(get_class($user), $user->getUsername(), $expires, $user->getPassword());
+
+        $response->headers->setCookie(
+            new Cookie(
+                $this->options['name'],
+                $value,
+                $expires,
+                $this->options['path'],
+                $this->options['domain'],
+                $this->options['secure'],
+                $this->options['httponly']
+            )
+        );
+    }
+
+    /**
+     * Generates the cookie value
+     *
+     * @param strign $class
+     * @param string $username The username
+     * @param integer $expires The unixtime when the cookie expires
+     * @param string $password The encoded password
+     * @throws \RuntimeException if username contains invalid chars
+     * @return string
+     */
+    protected function generateCookieValue($class, $username, $expires, $password)
+    {
+        return $this->encodeCookie(array(
+            $class,
+            base64_encode($username),
+            $expires,
+            $this->generateCookieHash($class, $username, $expires, $password)
+        ));
+    }
+
+    /**
+     * Generates a hash for the cookie to ensure it is not being tempered with
+     *
+     * @param string $class
+     * @param string $username The username
+     * @param integer $expires The unixtime when the cookie expires
+     * @param string $password The encoded password
+     * @throws \RuntimeException when the private key is empty
+     * @return string
+     */
+    protected function generateCookieHash($class, $username, $expires, $password)
+    {
+        return hash('sha256', $class.$username.$expires.$password.$this->key);
+    }
+}