Removal of some chars in tokens which can cause problems when sent via email (plus, slash, equals)

[MassiveHiggsField]

The current createToken method can create tokens which include chars that can cause some encoding issues later (e.g. "+", "/" and the trailing "="). Symfony's UrlSigner has already adapted a fix for that, see here.

I was a bit confused that this problem is not more widespread. Maybe it is because of some setup of our mail service... There seems to have been someone with a similar problem some time ago here #135 , but the user seems to have fixed it on their end.

We are seeing these problems when a generated token includes "+" or "/" in the URL. These result in something like this as token parameter in the URL:

exP7Pj6w%2BxqVTKG14YRwYxT%2FJXioLsnZhYG%2FKfHKQN8%3D

After sending this mail through our mail service in production, the url will be changed to:

exP7Pj6w%20xqVTKG14YRwYxT%2FJXioLsnZhYG%2FKfHKQN8

This must be some automatic encoding/parsing from the service itself, but since there might be other people using similar settings, UrlSigner also used these changes and there is no real loss in the change, it might be a good idea to implement it :)

Lastly, i have implemented it in a way, that already generated and sent token links will still work after an update. That might not really be needed though, idk.

If anyone finds this here because he has the same problems, if you are using it in a normal symfony application you can override the Generator this way (services.yaml):

services:
  'symfonycasts.verify_email.token_generator':
      class: App\Security\UrlSafeVerifyEmailTokenGenerator
      arguments:
          $key: '%kernel.secret%'

And create a class like this:

namespace App\Security;

use SymfonyCasts\Bundle\VerifyEmail\Generator\VerifyEmailTokenGenerator;

class UrlSafeVerifyEmailTokenGenerator extends VerifyEmailTokenGenerator
{
    public function createToken(string $userId, string $email): string
    {
        return strtr(rtrim(parent::createToken($userId, $email), '='), ['/' => '_', '+' => '-']);
    }
}

Be advised of course that tokens that were already sent via mail before patching, will not work anymore.