Check route redirects back to login form upon submit about 2fa HOT 3 CLOSED

Honestly, no idea 🤷. The setup looks to good to me.

Would be interesting where that AccessDeniedException is coming from and how the security looked like in that moment.

from 2fa.

Did you have a look at your Symfony profiler's Events panel ?

Do you have any Security related listeners that could interfere ?
Things that would listent to CheckPassportEvent::class, AuthenticationTokenCreatedEvent::class, LoginSuccessEvent::class, AuthenticationEvents::* and so on...

from 2fa.

Thank you for the replies! I hadn't had time to poke at this for a couple of weeks, but after taking another look it was indeed a problem with my legacy (PHP Bridge) sessions, as I had suspected.

I was calling \session_start() too late...often in the supports() of my custom authenticators, which was after Firewall\ContextListener->authenticate(). This was fine so long as my custom authenticators were the only ones in the mix, but obviously couldn't work with this bundle because it reads from TokenStorage before any of that happens.

To resolve it I made a kernel.request listener with higher priority than the firewall's, in which I can initialize my legacy sessions.

from 2fa.