Skip to content
Snippets Groups Projects
Commit 36657e2d authored by Oliver Hader's avatar Oliver Hader Committed by Helmut Hummel
Browse files

[TASK] Add backward compatibility handling for frontend login signing

The security fix for TYPO3-CORE-SA-2022-013 enforced the `pid`
HTTP parameter to be signed via HMAC during the frontend user
authentication process.

To provide better backward compatibility for those individual
scenarios, the new `security.frontend.enforceLoginSigning` feature
flag has been introduced, which is enabled per default, but can be
disabled individually.

Resolves: #99366
Releases: 11.5, 10.4
Change-Id: Ib633d7d3166a2f58caebc0a258699549b5cf2fa4
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/77155


Reviewed-by: default avatarHelmut Hummel <typo3@helhum.io>
Tested-by: default avatarStefan Bürk <stefan@buerk.tech>
Tested-by: default avatarcore-ci <typo3@b13.com>
Reviewed-by: default avatarStefan Bürk <stefan@buerk.tech>
Tested-by: default avatarHelmut Hummel <typo3@helhum.io>
parent 2fb8b444
Branches
Tags
No related merge requests found
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment