deprecated getKey() of the AnonymousToken, RememberMeToken,
AbstractRememberMeServices and DigestAuthenticationEntryPoint classes in favor of getSecret().
deprecated Symfony\Component\Security\Core\Authentication\SimplePreAuthenticatorInterface, use
Symfony\Component\Security\Http\Authentication\SimplePreAuthenticatorInterface instead
deprecated Symfony\Component\Security\Core\Authentication\SimpleFormAuthenticatorInterface, use
Symfony\Component\Security\Http\Authentication\SimpleFormAuthenticatorInterface instead
deprecated Symfony\Component\Security\Core\Util\ClassUtils, use
Symfony\Component\Security\Acl\Util\ClassUtils instead
deprecated the Symfony\Component\Security\Core\Util\SecureRandom class in favor of the random_bytes() function
deprecated supportsAttribute() and supportsClass() methods of
Symfony\Component\Security\Core\Authorization\AccessDecisionManagerInterface and
Symfony\Component\Security\Core\Authorization\Voter\VoterInterface.
deprecated getSupportedAttributes() and getSupportedClasses() methods of
Symfony\Component\Security\Core\Authorization\Voter\AbstractVoter, use supports() instead.
deprecated the intention option for all the authentication listeners,
use the csrf_token_id option instead.
2.7.0
added LogoutUrlGenerator
added the triggering of the Symfony\Component\Security\Http\SecurityEvents::INTERACTIVE_LOGIN in Symfony\Component\Security\Http\Firewall\SimplePreAuthenticationListener
The MaskBuilder logic has been abstracted in the Symfony\Component\Security\Acl\Permission\AbstractMaskBuilder
and described in the Symfony\Component\Security\Acl\Permission\MaskBuilderInterface
Deprecated the SecurityContext class in favor of the AuthorizationChecker and TokenStorage classes
2.4.0
Translations in the src/Symfony/Component/Security/Resources/translations/ directory are deprecated, ones in src/Symfony/Component/Security/Core/Resources/translations/ must be used instead.
The switch user listener now preserves the query string when switching a user
The remember-me cookie hashes now use HMAC, which means that current cookies will be invalidated
added simpler customization options
structured component into three sub-components Acl, Core and Http
added Csrf sub-component
changed Http sub-component to depend on Csrf sub-component instead of the Form component
2.3.0
[BC BREAK] the BCrypt encoder constructor signature has changed (the first argument was removed)
To use the BCrypt encoder, you now need PHP 5.5 or "ircmaxell/password-compat" as a composer dependency
[BC BREAK] return 401 instead of 500 when using use_forward during for form authentication
added a require_previous_session option to AbstractAuthenticationListener
2.2.0
Symfony\Component\Security\Http\Firewall and
Symfony\Component\Security\Http\RememberMe\ResponseListener now
implements EventSubscriberInterface
added secure random number generator
added PBKDF2 Password encoder
added BCrypt password encoder
2.1.0
[BC BREAK] The signature of ExceptionListener has changed
changed the HttpUtils constructor signature to take a UrlGenerator and a UrlMatcher instead of a Router
EncoderFactoryInterface::getEncoder() can now also take a class name as an argument
allow switching to the user that is already impersonated
added support for the remember_me parameter in the query
added AccessMapInterface
[BC BREAK] moved user comparison logic out of UserInterface
made the logout path check configurable
after login, the user is now redirected to default_target_path if
use_referer is true and the referrer is the login_path.
added a way to remove a token from a session
[BC BREAK] changed MutableAclInterface::setParentAcl to accept null,
review your implementation to reflect this change.
ObjectIdentity::fromDomainObject, UserSecurityIdentity::fromAccount and
UserSecurityIdentity::fromToken now return correct identities for proxies
objects (e.g. Doctrine proxies)
[BC BREAK] moved the default authentication success and failure handling to
separate classes. The order of arguments in the constructor of the
AbstractAuthenticationListener has changed.
[BC BREAK] moved the default logout success handling to a separate class. The
order of arguments in the constructor of LogoutListener has changed.
[BC BREAK] The constructor of AuthenticationException and all child
classes now matches the constructor of \Exception. The extra information
getters and setters are removed. There are now dedicated getters/setters for
token (AuthenticationException'), user (AccountStatusException) and
username (UsernameNotFoundException`).
