[Security] Custom authentication error messages

[xabbuh]

Starting with Symfony 2.8, we can easily throw an AuthenticationException in the Security subsystem with a custom error message thanks to the new CustomUserMessageAuthenticationException (see symfony/symfony#15882).

It must be made clear that the message configured here is likely to be shown to the user, so no sensitive information should be included in this message.

[weaverryan]

@xabbuh thanks for adding this issue :)

[diasgab]

Hi, i want to make my first contribution to symfony project so i'm looking for the easy pick issues. I wonder if this issue is related to "How to Build a Traditional Login Form" recipe from the security cookbook chapter:

Is it possible to show sensitive information just in dev environment and show a safe fixed message in prod?

[weaverryan]

Hi @diasgab!

Actually, if you print the "messageKey" from the object - e.g.

{{ error.messageKey|trans(error.messageData, 'security') }}

Then it is always safe. It's only unsafe if you try to use other things, like maybe error.message - which could contain any information. But the messageKey is always safe.