<table role="table">
<thead>
<tr>
<th>Q</th>
<th>A</th>
</tr>
</thead>
<tbody>
<tr>
<td>Bug report?</td>
<td>yes</td>
</tr>
<tr>
<td>Feature request?</td>
<td>no</td>
</tr>
<tr>
<td>BC Break report?</td>
<td>no</td>
</tr>
<tr>
<td>RFC?</td>
<td>no</td>
</tr>
<tr>
<td>Symfony version</td>
<td>3.3-dev</td>
</tr>
</tbody>
</table>
<p dir="auto"><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="158126671" data-permission-text="Title is private" data-url="https://github.com/symfony/symfony/issues/18952" data-hovercard-type="pull_request" data-hovercard-url="/symfony/symfony/pull/18952/hovercard" href="https://github.com/symfony/symfony/pull/18952">#18952</a></p>
<p dir="auto"><code class="notranslate">UsernamePasswordJsonAuthenticationListener</code> seems to "high-jack" every request. While the documentation <a href="http://symfony.com/doc/master/security/json_login_setup.html" rel="nofollow">http://symfony.com/doc/master/security/json_login_setup.html</a> seems to imply it supports things like <code class="notranslate">check_path</code> I do not see this in the code at all. It might make sense to extend from <code class="notranslate">AbstractAuthenticationListener</code>. At the very least the listener should check the <code class="notranslate">Content-Type</code> header if its a json request.</p>
<table role="table">
<thead>
<tr>
<th>Q</th>
<th>A</th>
</tr>
</thead>
<tbody>
<tr>
<td>Bug report?</td>
<td>yes</td>
</tr>
<tr>
<td>Feature request?</td>
<td>no</td>
</tr>
<tr>
<td>BC Break report?</td>
<td>no</td>
</tr>
<tr>
<td>RFC?</td>
<td>no</td>
</tr>
<tr>
<td>Symfony version</td>
<td>master</td>
</tr>
</tbody>
</table>
<p dir="auto">Json login listener tries to authenticate on all routes on the firewall it is registered on, not just the configured check_path. It even blocks access to routes that are configured to allow anonymous access.</p>
<p dir="auto">With this configuration</p>
<div class="highlight highlight-source-yaml notranslate position-relative overflow-auto" dir="auto" data-snippet-clipboard-copy-content="security:
    firewalls:
        customer:
            anonymous: ~
            stateless: true
            pattern: ^/customerapi
            provider: my_db_customers
            guard:
                authenticators:
                    - app.token_authenticator
            json_login:
                success_handler: app.customer_login_success_handler
                check_path: customer_login 
    access_control:
        - { path: ^/customerapi/login, roles: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/customerapi/account/create, roles: IS_AUTHENTICATED_ANONYMOUSLY }"><pre class="notranslate"><span class="pl-ent">security</span>:
    <span class="pl-ent">firewalls</span>:
        <span class="pl-ent">customer</span>:
            <span class="pl-ent">anonymous</span>: <span class="pl-c1">~</span>
            <span class="pl-ent">stateless</span>: <span class="pl-c1">true</span>
            <span class="pl-ent">pattern</span>: <span class="pl-s">^/customerapi</span>
            <span class="pl-ent">provider</span>: <span class="pl-s">my_db_customers</span>
            <span class="pl-ent">guard</span>:
                <span class="pl-ent">authenticators</span>:
                    - <span class="pl-s">app.token_authenticator</span>
            <span class="pl-ent">json_login</span>:
                <span class="pl-ent">success_handler</span>: <span class="pl-s">app.customer_login_success_handler</span>
                <span class="pl-ent">check_path</span>: <span class="pl-s">customer_login </span>
    <span class="pl-ent">access_control</span>:
        - <span class="pl-s">{ path: ^/customerapi/login, roles: IS_AUTHENTICATED_ANONYMOUSLY }</span>
        - <span class="pl-s">{ path: ^/customerapi/account/create, roles: IS_AUTHENTICATED_ANONYMOUSLY }</span></pre></div>
<p dir="auto">no route starting with ^/customerapi can be accessed without the json format credentials for a valid user.  Error messages in dev.log clearly show it is json authentication listener denying access.<br>
For example GET request to some route requiring authentication, with proper access token and empty HTTP body results in:</p>
<p dir="auto"><code class="notranslate">[2017-03-09 13:51:33] security.INFO: Guard authentication successful! {"token":"[object] (Symfony\\Component\\Security\\Guard\\Token\\PostAuthenticationGuardToken: PostAuthenticationGuardToken(user=\"*******@*****\", authenticated=true, roles=\"ROLE_CUSTOMER\"))","authenticator":"AppBundle\\Security\\CustomerTokenAuthenticator"} [] [2017-03-09 13:51:33] security.DEBUG: Guard authenticator set no success response: request continues. {"authenticator":"AppBundle\\Security\\CustomerTokenAuthenticator"} [] [2017-03-09 13:51:33] security.DEBUG: Remember me skipped: it is not configured for the firewall. {"authenticator":"AppBundle\\Security\\CustomerTokenAuthenticator"} [] [2017-03-09 13:51:33] security.INFO: An AuthenticationException was thrown; redirecting to authentication entry point. {"exception":"[object] (Symfony\\Component\\Security\\Core\\Exception\\BadCredentialsException(code: 0): Invalid JSON. at /home/lanttto/NetBeansProjects/AAh/vendor/symfony/symfony/src/Symfony/Component/Security/Http/Firewall/UsernamePasswordJsonAuthenticationListener.php:74)"}</code></p>
<p dir="auto">As far as I undestand from the documentation this is not intended behavior. Seems to lack a check against request path to only act when check_path is requested.</p>