Release 2.59 (#5957)

config/packages/security.yaml

@@ -47,6 +47,7 @@ security:
                 lifetime: 604800
                 path: /
                 always_remember_me: true
+                signature_properties: ['email', 'password', 'signatureDate']
 
             # activate all configured user provider
             provider: chain_provider
@@ -72,11 +73,11 @@ security:
 
             login_link:
                 check_route: link_login_check
-                # 'password' binds the HMAC signature to the password hash, so a
-                # link becomes invalid as soon as the user changes the password
-                signature_properties: ['id', 'password']
                 lifetime: 900
                 max_uses: 3
+                # 'password' binds the HMAC signature to the password hash, so a
+                # link becomes invalid as soon as the user changes the password
+                signature_properties: ['email', 'password', 'signatureDate']
 
     access_decision_manager:
         # only grants access if there is no voter denying access
@@ -98,7 +99,7 @@ security:
         - {path: '^/{_locale}/register', role: PUBLIC_ACCESS}
         - {path: '^/{_locale}/resetting', role: PUBLIC_ACCESS}
         - {path: '^/{_locale}/', roles: ROLE_USER}
-        - {path: '^/api', roles: IS_AUTHENTICATED}
+        - {path: '^/api', roles: IS_AUTHENTICATED_REMEMBERED}
 
 when@test:
     # this configuration simplifies testing URLs protected by the security mechanism