<table role="table">
<thead>
<tr>
<th>Q</th>
<th>A</th>
</tr>
</thead>
<tbody>
<tr>
<td>Bug report?</td>
<td>no</td>
</tr>
<tr>
<td>Feature request?</td>
<td>no</td>
</tr>
<tr>
<td>BC Break report?</td>
<td>no</td>
</tr>
<tr>
<td>RFC?</td>
<td>no</td>
</tr>
<tr>
<td>Symfony version</td>
<td>3.3.5</td>
</tr>
</tbody>
</table>
<p dir="auto">We have a custom user provider created based on <a href="https://symfony.com/doc/current/security/custom_provider.html" rel="nofollow">this documentation</a> and a custom authenticator based on <a href="http://symfony.com/doc/current/security/custom_password_authenticator.html" rel="nofollow">this documentation</a>. Furthermore we trigger the firewall ourselves during our routing, because we have dynamic firewalls depending on dynamic page paths and settings.</p>
<p dir="auto">Now with cookie based session authentication, the <a href="https://github.com/symfony/symfony/blob/6db73d3f4e47fad0be4973b83fb3402bd2321b35/src/Symfony/Component/Security/Http/Firewall/ContextListener.php#L168">ContextListener</a> calls <code class="notranslate">refreshUser()</code> on the provider.</p>
<p dir="auto">The token is still not authenticated here. Only a first <strong>authorization</strong> request such as configured access directives on the route or a call to <code class="notranslate">isGranted()</code> will cause the token to be <strong>authenticated</strong>, which is fine, we can still manually authenticate the token if need be.</p>
<p dir="auto">However, upon authentication the authenticator will call <code class="notranslate">loadUserByUsername()</code>, loading the user again, despite the <code class="notranslate">refreshUser()</code> before.</p>
<p dir="auto">What is the intended workflow here? Is the documentation faulty? Should the authenticator not load the user again? Or should the ContextListener not refresh the user? Because right now the only thing the refresh does is finding out if the user was deleted, but all the other checks, like the user's isActive-flag, are only checked during authentication. Maybe the ContextListener should immediately authenticate the user?</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="$in = &lt;&lt;&lt;EOF
a:
  b: 5
  b: 6
EOF;
var_dump(\Symfony\Component\Yaml\Yaml::parse($in));"><pre class="notranslate"><code class="notranslate">$in = &lt;&lt;&lt;EOF
a:
  b: 5
  b: 6
EOF;
var_dump(\Symfony\Component\Yaml\Yaml::parse($in));
</code></pre></div>
<p dir="auto">will give that a[b] = 5 instead of complaining b was defined twice.</p>