From 907c92c809b1a7ce0b8818d686cbad7f40b57cb4 Mon Sep 17 00:00:00 2001 From: Nicolas Grekas Date: Fri, 9 Oct 2026 16:05:12 +0200 Subject: [PATCH] Declare the position of TwoFactorAccessListener with #[FirewallListenerOrder] --- src/bundle/Security/Http/Firewall/TwoFactorAccessListener.php | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/src/bundle/Security/Http/Firewall/TwoFactorAccessListener.php b/src/bundle/Security/Http/Firewall/TwoFactorAccessListener.php index b808b6b3..162298a9 100644 --- a/src/bundle/Security/Http/Firewall/TwoFactorAccessListener.php +++ b/src/bundle/Security/Http/Firewall/TwoFactorAccessListener.php @@ -12,14 +12,18 @@ use Symfony\Component\HttpKernel\Event\RequestEvent; use Symfony\Component\Security\Core\Authentication\Token\Storage\TokenStorageInterface; use Symfony\Component\Security\Core\Exception\AccessDeniedException; +use Symfony\Component\Security\Http\Attribute\FirewallListenerOrder; use Symfony\Component\Security\Http\Firewall\AbstractListener; +use Symfony\Component\Security\Http\Firewall\AccessListener; use Symfony\Component\Security\Http\Firewall\FirewallListenerInterface; +use Symfony\Component\Security\Http\Firewall\LogoutListener; /** * Handles access control in the "2fa in progress" phase. * * @final */ +#[FirewallListenerOrder(before: AccessListener::class, after: LogoutListener::class)] class TwoFactorAccessListener extends AbstractListener implements FirewallListenerInterface { public function __construct(