Argument #3 ($token) must be of type TokenInterface, null given about 2fa HOT 7 CLOSED

Looks as if there's a request against /2fa_check when the user hasn't even completed the initial login yet.

Would you please post your security.yaml configuration?

from 2fa.

Correct, I just did a POST using command line to /2fa_check and replicated the error in dev.

I can't post the whole yaml but here are relevant parts...

main:
      pattern: /
      host: "%manage_subdomain%.mysites.guru"
      remember_me:
        secret:   '%kernel.secret%'
        lifetime: 2592000 # 1 month in seconds
        path:     /
        httponly: true
        samesite: 'strict'
        name: _rememberme
      two_factor:
        auth_form_path: 2fa_login
        check_path: 2fa_login_check
      custom_authenticators:
        - Base\Security\Authenticator
      lazy: true
      provider: users
      switch_user:  { parameter: _switch_user }
      logout:
        path: app_logout

- { path: ^/2fa, role: IS_AUTHENTICATED_2FA_IN_PROGRESS }

from 2fa.

Just thought IS_AUTHENTICATED_2FA_IN_PROGRESS should actually prevent that from happening, but then I remembered the authenticator is actually executed before access control. So it's running into this

and then further down a token is expected when it's actually null.

I'll add a null check for that case.

from 2fa.

Sorry :) pleased it was a quick easy painless issue :)

from 2fa.

Released v5.4.2 with a fix

from 2fa.

Awesome - let me jump and test that for you....

from 2fa.

Perfect! Thanks for the quick fix. Works perfectly for me.

from 2fa.