Symfony4升级至6后HTTP认证出现PasswordUpgradeBadge错误求助

将Symfony 4升级到6版本后，配置了HTTP认证的防火墙在登录成功后访问路由时抛出逻辑异常：
The password is erased as another listener already used this badge.

相关配置 #

防火墙配置（security.yaml） #

xxx:
    pattern: ^/xxx
    provider: chain_provider
    http_basic: ~

用户提供者配置（security.yaml） #

providers:
    fos_userbundle:
        id: fos_user.user_provider.username_email
    in_memory:
        memory:
            users:
                {...}
    chain_provider:
        chain:
            providers: [ in_memory, fos_userbundle ]

密码哈希配置（security.yaml） #

password_hashers:
    FOS\UserBundle\Model\UserInterface: bcrypt
    Symfony\Component\Security\Core\User\InMemoryUser: bcrypt

错误详情 #

异常抛出位置：vendor/symfony/security-http/Authenticator/Passport/Badge/PasswordUpgradeBadge.php:45，对应代码片段：

public function getAndErasePlaintextPassword(): string
{
    $password = $this->plaintextPassword;
    if (null === $password) {
        throw new LogicException('The password is erased as another listener already used this badge.');
    }

    $this->plaintextPassword = null;

    return $password;
}

该方法由vendor/symfony/security-http/EventListener/PasswordMigratingListener.php:46触发调用，相关代码：

public function onLoginSuccess(LoginSuccessEvent $event): void
{
    $passport = $event->getPassport();
    if (!$passport->hasBadge(PasswordUpgradeBadge::class)) {
        return;
    }

    /** @var PasswordUpgradeBadge $badge */
    $badge = $passport->getBadge(PasswordUpgradeBadge::class);
    $plaintextPassword = $badge->getAndErasePlaintextPassword();
    // 后续密码迁移逻辑
}

已做排查 #

• 仅禁用防火墙的http_basic配置时，系统可正常运行，但业务需要保留HTTP认证方式
• 更换用户提供者或哈希算法（如改用argon2i）均无法解决该异常
• 此前系统密码使用plain_text格式，修改为bcrypt哈希后出现此问题
• 使用命令bin/console security:hash-password为InMemoryUser生成哈希时，系统自动使用了MigratingPasswordHasher：

--------------- ----------------------------------------------------------------- 
  Key             Value                                                            
 --------------- ----------------------------------------------------------------- 
  Hasher used     Symfony\Component\PasswordHasher\Hasher\MigratingPasswordHasher  
  Password hash   xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx     
 --------------- ----------------------------------------------------------------- 

• 未配置任何自定义的日志、用户或安全相关事件监听器

疑问 #

1. 升级及配置过程中哪里操作有误？
2. 为何无论配置何种哈希算法，系统都会调用MigratingPasswordHasher？

内容的提问来源于stack exchange，提问作者Matys333