Problem/Motivation

In FrankenPHP worker mode, requests reuse the kernel and services. AuthenticationSubscriber::onKernelRequestAuthenticate()sets the current account only when a provider returns one. If the provider returns nothing or an exception is thrown, the current_user proxy keeps the account from the previous request.

Steps to reproduce

  1. Use a test authentication provider that returns an authenticated user.
  2. Handle and terminate a main request for the authenticated user.
  3. Using the same kernel and container, handle another main request for an anonymous user.
  4. Observe that the current user is still the authenticated user. It should be anonymous.

Proposed resolution

At the start of each main request, set the current user to anonymous before checking providers for each main request.

AI disclosure: I used AI to help prepare the IS and MR (Astra and Opus 5.5).

Issue fork drupal-3626326

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

Comments

ptmkenny created an issue. See original summary.

ptmkenny’s picture

Status: Active » Needs work

Adding a draft MR for this but there is no test so I'm setting it to "Needs work." There may also be a better way to fix this...

ptmkenny’s picture

Actually, thinking about this some more, it's probably better to call AccountProxy::reset() during cleanup.