Verificación de la URL firmada del correo electrónico de confirmación

Hey @Rsteuber!

Sorry for the slow reply! Hmm, this kind of failure is tough - it's hard to debug. What we need to know is why is it invalid? And the bundle doesn't give better errors because, for production, sometimes we want to hide that info. To figure out the problem, exactly which exception class is being thrown? That would show us which part of this function - https://github.com/SymfonyCasts/verify-email-bundle/blob/main/src/VerifyEmailHelper.php#L62-L77 - is failing. You mentioned that it says that the "link is invalid", which makes me think it's the InvalidSignatureException. If that's true, then there's a problem with the "signed url", which is odd. We use a UriSigner class from Symfony and the logic is pretty simple:

A) We ask it to sign the URL - https://github.com/SymfonyCasts/verify-email-bundle/blob/main/src/VerifyEmailHelper.php#L56
B) We as it to verify that signature - https://github.com/SymfonyCasts/verify-email-bundle/blob/main/src/VerifyEmailHelper.php#L64

I would put a dump when the request is signed (dump $signature in A) then compare that to the URL when you click the link. It may be that we're losing part of the URL... or there is some URL or HTML encoding that is slightly changing it. It needs to be exactly the same.

Let me know if this helps!

Cheers!

Hey Ryan,

No problem for replying so late. We are busy too so totally understandable :)

I've dumped the $signature and compared it with the link in the email. Turns out they are exactly the same:

------ dump ------
verify?expires=1701263583&id=27&signature=eJHNOlI3HkWXhZOJfpJrTeIOEjdYR2pJuOtE8l0ktFQ%3D&token=UGMyl2OXc8HLSCU9qRZ9Pn3%2BRn1ovX%2BVXXq8AQmz5gI%3D

------ link ------
verify?expires=1701263583&id=27&signature=eJHNOlI3HkWXhZOJfpJrTeIOEjdYR2pJuOtE8l0ktFQ%3D&token=UGMyl2OXc8HLSCU9qRZ9Pn3%2BRn1ovX%2BVXXq8AQmz5gI%3D

That seems a bit awkward to me.
Is there somehow a way to get the real exception message?

Cheers! 🍻

Hey @Rsteuber!

Hmm, that is mysterious! To get more info, I would:

A) First, triple-check that this line is the problem - https://github.com/SymfonyCasts/verify-email-bundle/blob/main/src/VerifyEmailHelper.php#L69 - e.g. put a die in front of the exception. Better, a dd($signedUrl) to be sure.

B) To debug further, inside of Symfony's core itself, find the UriSigner class and put some debugging inside the check() method - https://github.com/symfony/symfony/blob/7.1/src/Symfony/Component/HttpFoundation/UriSigner.php#L59-L75

I'm hoping this will help figure out what difference the UriSigner is seeing that's causing the difference. I'd compare, specifically, what the $uri and $this->secret look like both when the URL is created and when it's checked in this method https://github.com/symfony/symfony/blob/7.1/src/Symfony/Component/HttpFoundation/UriSigner.php#L86-L89

Let me know what you find out - it's gotta be something small...

Cheers!

Ok, I have found something weird...

The query parameters is giving me this:
"query" => "%3Fexpires=1701721532&id=30&signature=C37Z9HCzWS5GuCanWzEYexMuvrpAJkKE2yuHQs9Rllk%3D&token=P%2BzNwEnF%2FBhMD%2B24xuU9N9I9bqJuxbB3YuyxgEuz89c%3D"

But when I dd($params), it is showing me a weird token like it has been decoded:
array:3 [▼ "?expires" => "1701721532" "id" => "30" "token" => "P+zNwEnF/BhMD+24xuU9N9I9bqJuxbB3YuyxgEuz89c=" ]

The %2B = transformed into a "+" character. Could that be the problem to this case?

Cheers!

That would be enough to cause the signing to fail. Or it could be a false clue. If you, temporarily, manually hacked in code to make the + go back to %2B and tried it (or, more generally, you could urldecode that part), and it works, then I think we might have something. Otherwise, this could just be a false alarm an we just happen to be comparing the urlencoded and urldecoded strings. But even if this is the cause, I'm not really sure what's going on yet...

Ok, I am trying to figure it out today and think I see the problem now!

When i use the $request->getUri() method, it seems that it adds some extra characters into the uri right before the "expires" query param. (%3F)

So.... If I use the following code in my controller, it goes well:

$uri = $request->getScheme() .  '://'. $request->getHost() . $request->getRequestUri();
$this->verifyEmailHelper->validateEmailConfirmation($uri, $user->getId(), $user->getEmail());

Wondering if other people got this same problem?

Cheers!

Hey @Rsteuber!

Really glad you figured it out! And yea, this is strange! You said:

When i use the $request->getUri() method, it seems that it adds some extra characters into the uri right before the "expires" query param. (%3F)

That %3F is the ? character. the getUri() method does add this character - https://github.com/symfony/symfony/blob/aa8e74b1c27890850b541c27ab7b05203cf06524/src/Symfony/Component/HttpFoundation/Request.php#L955 - but it shouldn't be adding an extra one. The $this->getQueryString() should return something like expires=...&foo=bar, and so adding the ? should be proper to reconstruct the URL. It also wouldn't show as URL encoded as %3F. It feels like there is an extra %3F in the URL when you come to the page... and so you're stripping effectively stripping that, but I also have a feeling I may be misreading things. If this were a bug, I'm sure we would have heard about it, but I'm not sure what you're doing differently.

However, I do think there may be a problem. Notice UriSigner has a checkRequest() helper method - https://github.com/symfony/symfony/blob/7.1/src/Symfony/Component/HttpFoundation/UriSigner.php#L83 - and it gets the URL in a different way, purposely not using getUri(). That may or may not be describing your problem, but I'm thinking we should use that method in the bundle to url signing validation. https://github.com/SymfonyCasts/verify-email-bundle/issues/155

Cheers!

Hey Juan E.!

Hmm, that's a mystery! And you've asked the correct questions: how to debug / find out what happened during that redirection.

Here's what I like to do:

A) In config/packages/dev/web_profiler.yaml, you should have a intercept_redirects: false line. Change that to intercept_redirects: true.

B) Now, whenever Symfony redirects you, instead of redirecting, you will see a page that says something like "About to redirect you to http://...". But it hasn't actually redirected you.

How is that useful? Because now you can do this:

1) Click the link, which will hit this URL, submit the form and (should) authenticate the user (make sure you put your redirectToRoute() back)
2) But, instead of redirecting, it will stop and show you the message. The useful thing is that, on this screen, you will see the web debug toolbar for this page. The question is: do you see yourself as authenticated in the web debug toolbar?

The answer to this question will tell us where to look next. If you ARE authenticated (but then when you click the link to "follow the redirect" suddenly you are not authenticated), then you are "losing" authentication, probably because some data on your User object is being seen as "changed" (if you have this situation, I can tell you more - it is common if you, for some reason, implement a custom \Serializable interface on your User class, which you probably shouldn't have).

Let me know what you find out.

Cheers!

Hi I just managed to make it work using the rememberMe Handler Interface and adding this line before the redirect:

$rememberMe->createRememberMeCookie($this->getUser());

Hi, as I said in the previous reply I still get "kicked out" this is my User.php entity, I wonder if the libPhoneNumber object could be the problem.

`<?php

namespace App\Entity;

use Doctrine\Common\Collections\ArrayCollection;
use Doctrine\Common\Collections\Collection;
use Doctrine\ORM\Mapping as ORM;
use Symfony\Component\Security\Core\User\UserInterface;
use Symfony\Component\Serializer\Annotation\Groups;
use Symfony\Component\Validator\Constraints as Assert;
use Symfony\Bridge\Doctrine\Validator\Constraints\UniqueEntity;
use Adamski\Symfony\PhoneNumberBundle\Model\PhoneNumber;
use Adamski\Symfony\PhoneNumberBundle\Validator\Constraints\PhoneNumber as AssertPhoneNumber;

/**

• @ORM\Entity(repositoryClass=App\Repository\UserRepository::class)
• @UniqueEntity(fields={"email"}, message="This value is already used.")
  */
  class User implements UserInterface
  {

const REGISTERED_SUCCESFULLY = 'Se ha registrado exitosamente';
/**
 * @ORM\Id
 * @ORM\GeneratedValue
 * @ORM\Column(type="integer")
 */
private $id;

/**
 * @ORM\Column(type="string", length=180, unique=true)
 * @Groups("main")
 * 
 * @Assert\NotBlank()
 * @Assert\Email()
 */
private $email;

/**
 * @ORM\Column(type="json")
 * @Groups("main")
 *
 */
private $roles = [];

/**
 * @var string The hashed password
 * @ORM\Column(type="string", nullable=true)
 * @Assert\NotBlank()
 */
private $password;

/**
 * @ORM\Column(type="string", length=2, nullable=true)
 * @Groups("main")
 */
private $langue;

/**
 * @ORM\Column(type="string", length=255, nullable=true)
 * @Groups("main")
 * @Assert\NotBlank()
 */
private $nom;

/**
 * @ORM\Column(type="string", length=255, nullable=true)
 * @Groups("main")
 * @Assert\NotBlank()
 */
private $prenom;

/**
 * @Groups("main")
 * @AssertPhoneNumber
 * @ORM\Column(name="telephone", type="phone_number", nullable=true)
 */

private $telephone;

/**
 * @ORM\Column(type="string", length=15, nullable=true)
 * @Groups("main")
 */
private $position;

/**
 * @ORM\Column(type="datetime")
 * @Groups("main")
 */
private $date_ajout;

/**
 * @ORM\ManyToMany(targetEntity=Dates::class, inversedBy="users")
 */
private $date;

/**
 * @ORM\OneToMany(targetEntity=Reservation::class, mappedBy="user", cascade={"persist","remove"})
 */
private $reservation;

/**
 * @ORM\OneToMany(targetEntity=BlogTranslation::class, mappedBy="user", orphanRemoval=true)
 */
private $blogTranslations;

/**
 * @ORM\OneToMany(targetEntity=Document::class, mappedBy="user")
 */
private $documents;

/**
 * @ORM\OneToMany(
 *                  targetEntity=Travellers::class, 
 *                  mappedBy="user",
 *                  fetch="EXTRA_LAZY",
 *                  orphanRemoval=true,
 *                  cascade={"persist"}
 * )
 */

private $travellers;

/**
 * @ORM\Column(type="string", length=255, nullable=true)
 */
private $address;

/**
 * @ORM\Column(type="string", length=6, nullable=true)
 */
private $postcode;

/**
 * @ORM\Column(type="string", length=255, nullable=true)
 */
private $city;

/**
 * @ORM\Column(type="string", length=255, nullable=true)
 */
private $country;

/**
 * @ORM\Column(type="string", length=255, nullable=true)
 */
private $nationality;

/**
 * @ORM\Column(type="string", length=3, nullable=true)
 */
private $sizes;

/**
 * @ORM\Column(type="string", length=255, nullable=true)
 */
private $verification;

/**
 * @ORM\OneToMany(targetEntity=ReservationData::class, mappedBy="User", orphanRemoval=true)
 */
private $reservationData;

/**
 * @ORM\OneToMany(targetEntity=Codespromo::class, mappedBy="user")
 */
private $codespromos;

/**
 * @ORM\Column(type="boolean")
 */
private $isVerified = false;

public function __construct()
{
    $this->date = new ArrayCollection();
    $this->reservation = new ArrayCollection();
    $this->blogTranslations = new ArrayCollection();
    $this->documents = new ArrayCollection();
    $this->travellers = new ArrayCollection();
    $this->reservations = new ArrayCollection();
    $this->reservationData = new ArrayCollection();
    $this->codespromos = new ArrayCollection();
}

public function getId(): ?int
{
    return $this->id;
}

public function getEmail(): ?string
{
    return $this->email;
}

public function setEmail(string $email): self
{
    $this->email = $email;

    return $this;
}
/**
 * A visual identifier that represents this user.
 *
 * @see UserInterface
 */
public function getUserIdentifier(): string
{
    return (string)$this->email;
}

/**
 * @deprecated since Symfony 5.3, use getUserIdentifier instead
 *
 */
public function getUsername(): string
{
    return (string) $this->email;
}

/**
 * @see UserInterface
 */
public function getRoles(): array
{
    $roles = $this->roles;
    // guarantee every user at least has ROLE_USER
    $roles[] = 'ROLE_USER';

    return array_unique($roles);
}

public function setRoles(array $roles): self
{
    $this->roles = $roles;

    return $this;
}

/**
 * @see UserInterface
 */
public function getPassword(): string
{
    return (string) $this->password;
}

public function setPassword(string $password): self
{
    $this->password = $password;

    return $this;
}

/**
 * Returning a salt is only needed, if you are not using a modern
 * hashing algorithm (e.g. bcrypt or sodium) in your security.yaml.
 *
 * @see UserInterface
 */
public function getSalt(): ?string
{
    return null;
}

/**
 * @see UserInterface
 */
public function eraseCredentials()
{
    // If you store any temporary, sensitive data on the user, clear it here
    // $this->plainPassword = null;
}

public function getLangue(): ?string
{
    return $this->langue;
}

public function setLangue(string $langue): self
{
    $this->langue = $langue;

    return $this;
}

public function getNom(): ?string
{
    return $this->nom;
}

public function setNom(string $nom): self
{
    $this->nom = $nom;

    return $this;
}

public function getPrenom(): ?string
{
    return $this->prenom;
}

public function setPrenom(string $prenom): self
{
    $this->prenom = $prenom;

    return $this;
}

public function getTelephone(): ?PhoneNumber
{
    return $this->telephone;
}

public function setTelephone(?PhoneNumber $telephone): self
{
    $this->telephone = $telephone;

    return $this;
}

public function getPosition(): ?string
{
    return $this->position;
}

public function setPosition(?string $position): self
{
    $this->position = $position;

    return $this;
}

public function getDateAjout(): ?\DateTimeInterface
{
    return $this->date_ajout;
}

public function setDateAjout(\DateTimeInterface $date_ajout): self
{
    $this->date_ajout = $date_ajout;

    return $this;
}

/**
 * @return Collection|Dates[]
 */
public function getDate(): Collection
{
    return $this->date;
}

public function addDate(Dates $date): self
{
    if (!$this->date->contains($date)) {
        $this->date[] = $date;
    }

    return $this;
}

public function removeDate(Dates $date): self
{
    $this->date->removeElement($date);

    return $this;
}

/**
 * @return Collection|Reservations[]
 */
public function getReservation(): Collection
{
    return $this->reservation;
}

public function addReservation(Reservation $reservation): self
{
    if (!$this->reservation->contains($reservation)) {
        $this->reservation[] = $reservation;
    }

    return $this;
}

public function removeReservation(Reservation $reservation): self
{
    $this->reservation->removeElement($reservation);

    return $this;
}

/**
 * @return Collection|BlogTranslation[]
 */
public function getBlogTranslations(): Collection
{
    return $this->blogTranslations;
}

public function addBlogTranslation(BlogTranslation $blogTranslation): self
{
    if (!$this->blogTranslations->contains($blogTranslation)) {
        $this->blogTranslations[] = $blogTranslation;
        $blogTranslation->setUser($this);
    }

    return $this;
}

public function removeBlogTranslation(BlogTranslation $blogTranslation): self
{
    if ($this->blogTranslations->removeElement($blogTranslation)) {
        // set the owning side to null (unless already changed)
        if ($blogTranslation->getUser() === $this) {
            $blogTranslation->setUser(null);
        }
    }

    return $this;
}

/**
 * @return Collection|Document[]
 */
public function getDocuments(): Collection
{
    return $this->documents;
}

public function addDocument(Document $document): self
{
    if (!$this->documents->contains($document)) {
        $this->documents[] = $document;
        $document->setUser($this);
    }

    return $this;
}

public function removeDocument(Document $document): self
{
    if ($this->documents->removeElement($document)) {
        // set the owning side to null (unless already changed)
        if ($document->getUser() === $this) {
            $document->setUser(null);
        }
    }

    return $this;
}

/**
 * @return Collection|Travellers[]
 */
public function getTravellers(): Collection
{
    return $this->travellers;
}

public function addTraveller(Travellers $traveller): self
{
    if (!$this->travellers->contains($traveller)) {
        $this->travellers[] = $traveller;
        $traveller->setUser($this);
    }

    return $this;
}

public function removeTraveller(Travellers $traveller): self
{
    if ($this->travellers->removeElement($traveller)) {
        // set the owning side to null (unless already changed)
        if ($traveller->getUser() === $this) {
            $traveller->setUser(null);
        }
    }

    return $this;
}

public function __toString(): string
{
    return $this->getUserIdentifier();
}

/**
 * @return Collection|Reservation[]
 */
public function getReservations(): Collection
{
    return $this->reservation;
}

public function getAddress(): ?string
{
    return $this->address;
}

public function setAddress(?string $address): self
{
    $this->address = $address;

    return $this;
}

public function getPostcode(): ?string
{
    return $this->postcode;
}

public function setPostcode(?string $postcode): self
{
    $this->postcode = $postcode;

    return $this;
}

public function getCity(): ?string
{
    return $this->city;
}

public function setCity(?string $city): self
{
    $this->city = $city;

    return $this;
}

public function getCountry(): ?string
{
    return $this->country;
}

public function setCountry(?string $country): self
{
    $this->country = $country;

    return $this;
}

public function getNationality(): ?string
{
    return $this->nationality;
}

public function setNationality(?string $nationality): self
{
    $this->nationality = $nationality;

    return $this;
}

public function getSizes(): ?string
{
    return $this->sizes;
}

public function setSizes(?string $sizes): self
{
    $this->sizes = $sizes;

    return $this;
}

public function getVerification(): ?string
{
    return $this->verification;
}

public function setVerification(?string $verification): self
{
    $this->verification = $verification;

    return $this;
}

/**
 * @return Collection|ReservationData[]
 */
public function getReservationData(): Collection
{
    return $this->reservationData;
}

public function addReservationData(ReservationData $reservationData): self
{
    if (!$this->reservationData->contains($reservationData)) {
        $this->reservationData[] = $reservationData;
        $reservationData->setUser($this);
    }

    return $this;
}

public function removeReservationData(ReservationData $reservationData): self
{
    if ($this->reservationData->removeElement($reservationData)) {
        // set the owning side to null (unless already changed)
        if ($reservationData->getUser() === $this) {
            $reservationData->setUser(null);
        }
    }

    return $this;
}

/**
 * @return Collection|Codespromo[]
 */
public function getCodespromos(): Collection
{
    return $this->codespromos;
}

public function addCodespromo(Codespromo $codespromo): self
{
    if (!$this->codespromos->contains($codespromo)) {
        $this->codespromos[] = $codespromo;
        $codespromo->setUser($this);
    }

    return $this;
}

public function removeCodespromo(Codespromo $codespromo): self
{
    if ($this->codespromos->removeElement($codespromo)) {
        // set the owning side to null (unless already changed)
        if ($codespromo->getUser() === $this) {
            $codespromo->setUser(null);
        }
    }

    return $this;
}

public function getIsVerified(): ?bool
{
    return $this->isVerified;
}

public function setIsVerified(bool $isVerified): self
{
    $this->isVerified = $isVerified;

    return $this;
}

}`

Hi thank you, I have proceeded following your indications and so far I find my self in the place we expected. By preventing direct redirection I got to that "intermediate" page and the user was still logged in, but after redirection it disappeared. Since the project I am managing "inherits" many elements from a former project I will clean up the data model of the user class and then test again, if I get no progress I may send here the User.php entity class with the hope you may find something I couldn't, I will try tomorrow and whatever the outcome I will post it here. Thanks so much.

Hey Juan!

I see that you got this working, I just wanted to apologize for not replying - I'm not sure how I lost this message! Overall, your solution is probably fine. If you'd like to learn more about the underlying issue and solution, you can read about it on this thread: https://symfonycasts.com/sc...

Cheers!

Hey Ruslan,

I think you need to translate the exact text if the error is from core Symfony. If the error message is your custom - you can use a translation message key, translate it in translation files, and use the translator in that spot to translate.

I hope this helps!

Cheers!

Hi Victor,
In this tutorial, we have changed Error messages for Login form (lesson 10) in translations\security.en.yaml. As I understand "security" is domain and I can see it in debug bar "Translation".
$e->getReason() is from VerifyEmailExceptionInterface. - but here I miss understand how to translate (I mean translation file name)

Thank you.

Looks like I understand my fault.
in this code I need to pass $error
-----
} catch (VerifyEmailExceptionInterface $e){
$this->addFlash('error', $e->getReason());

return $this->redirectToRoute('app_register');
}
-----

and in twig use the same construction like in login.html.twig.
<div class="alert alert-danger">{{ error.messageKey|trans(error.messageData, 'security') }}</div>

Am I right?

Hey Ruslan,

I'm not sure you can pass the error object, IIRC you can only pass string to the addFlash() method. So, either you need to translate the message in PHP using trans() method before pass the string to the addFlash(), or you can pass the untranslated string to the addFlash() and translate it later in the template, i.e. "<div class="alert alert-success">{{ flash|trans }}</div>" as you mentioned, but yeah, if the message requires some messageData - it you do need to pass it into the template somehow, so probably better to translate in PHP where you have access to the object.

But if it's possible to pass the object - yeah, you can try your solution as well then. But you would need one more check in the template - you would need to know if you passed a string or an object and so render it a bit differently.

Cheers!