Symfony 4.x中Steam OpenID认证后令牌丢失问题求助

Hey there, let's dig into this Steam auth persistence issue you're facing in Symfony 4.x. I've dealt with similar OpenID session quirks before, so here are the key areas to check and fix:

Symfony relies on serializing authentication tokens to store them in the session. If your SteamUserToken doesn't handle serialization correctly, it won't persist across page refreshes.

• Make sure your token class implements the Serializable interface (or uses PHP 7.4+'s __serialize()/__unserialize() methods if you prefer). Don't forget to include the parent class's serialized data too:

  use Symfony\Component\Security\Core\Authentication\Token\AbstractToken;
  use Serializable;
  
  class SteamUserToken extends AbstractToken implements Serializable
  {
      private $steamId;
  
      // ... your existing methods
  
      public function serialize()
      {
          return serialize([
              $this->steamId,
              parent::serialize(), // Critical: include parent token data
          ]);
      }
  
      public function unserialize($serialized)
      {
          list($this->steamId, $parentData) = unserialize($serialized);
          parent::unserialize($parentData);
      }
  }
  

• Double-check that all properties in your token are serializable (no closures, resource objects, or unhandled private properties).

If your session isn't being stored properly, the token will disappear after a refresh.

• Check config/packages/framework.yaml to ensure you're using a persistent session handler (not the default in-memory handler which is only for dev/test):

  framework:
      session:
          handler_id: session.handler.native_file
          save_path: '%kernel.project_dir%/var/sessions/%kernel.environment%'
          cookie_secure: auto
          cookie_samesite: lax
          cookie_lifetime: 86400 # Adjust as needed
  

• Confirm the session cookie's domain and path match your site's URL (if you have subdomains or specific paths, these need to be set correctly to avoid cookie mismatches).

When Steam authentication succeeds, you need to explicitly save the session to ensure the token is written before redirecting.

• Update your SteamListener to force a session save after setting the token:

  use Symfony\Component\Security\Core\Authentication\Token\Storage\TokenStorageInterface;
  use Symfony\Component\HttpFoundation\Session\SessionInterface;
  
  class SteamListener
  {
      private $tokenStorage;
      private $session;
      private $userRepository;
  
      public function __construct(TokenStorageInterface $tokenStorage, SessionInterface $session, UserRepository $userRepository)
      {
          $this->tokenStorage = $tokenStorage;
          $this->session = $session;
          $this->userRepository = $userRepository;
      }
  
      public function onSteamAuthenticationSuccess(SteamAuthenticationSuccessEvent $event)
      {
          $steamUser = $event->getSteamUser();
          $localUser = $this->userRepository->findOneBy(['steamId' => $steamUser->getSteamId()]);
  
          // Create user if they don't exist
          if (!$localUser) {
              $localUser = new User();
              $localUser->setSteamId($steamUser->getSteamId());
              // ... set other user properties
              $this->userRepository->save($localUser, true);
          }
  
          // Initialize and set the Steam token
          $token = new SteamUserToken($localUser->getRoles());
          $token->setUser($localUser);
          $token->setSteamId($steamUser->getSteamId());
  
          $this->tokenStorage->setToken($token);
          
          // Critical: Force session save before redirect
          $this->session->save();
      }
  }
  

If your Steam auth uses a separate firewall from your email/password auth, the session tokens won't be shared.

• Ensure both authentication methods are under the same firewall in config/packages/security.yaml:

  security:
      firewalls:
          main:
              pattern: ^/
              anonymous: true
              form_login:
                  login_path: login
                  check_path: login
                  # Your email/password config
              guard:
                  authenticators:
                      - App\Security\SteamAuthenticator # Your Steam authenticator
              logout:
                  path: logout
                  target: home
  

• Avoid creating a dedicated firewall for Steam auth—this breaks session token persistence across requests.

To confirm what's happening with your session, add a debug route to inspect the token before and after a refresh:

use Symfony\Component\HttpFoundation\Response;
use Symfony\Component\Security\Core\Authentication\Token\Storage\TokenStorageInterface;
use Symfony\Component\HttpFoundation\Session\SessionInterface;

/**
 * @Route("/debug-session", name="debug_session")
 */
public function debugSession(TokenStorageInterface $tokenStorage, SessionInterface $session): Response
{
    dump('Current Token:', $tokenStorage->getToken());
    dump('Session Contents:', $session->all());
    return new Response('Check the profiler for session data');
}

• Visit this route right after Steam auth succeeds, then refresh the page and check again. If the Steam token disappears, you know the issue is with serialization/session storage.

内容的提问来源于stack exchange，提问作者GasKa