[HttpKernel] Add temporary URI signed

[BaptisteContreras]

Q	A
Branch?	7.1
Bug fix?	no
New feature?	yes
Deprecations?	no
Tickets	Fix #51501
License	MIT
Doc PR	TODO

This feature add the possibilty to create a temporary URI signed as mentionned in #51501.

Few things about this implementation :

• I added an optional parameter to the constructor of the UriSigner. I'm not sure if it can be considered as a BC ?
• The query parameter for expiration (by default "_expiration") is considered as a reserved parameter for the signer and if you try to sign an URI with this parameter, the method will throw
  a LogicalException. In fact, the check method will test the presence of the expiration query parameter to determine if it must (or not) verify the expiration.
  A problem can arise in this case : Lets say you want to sign this URI : "/demo?_expiration=foo" and you don't want a temporary URL. The URI is signed without problem but when you try to call check, the method will notice the
  presence of "_expiration" and try to determine if it has expired, considering the value "foo" as a timestamp.

[BaptisteContreras]

PR updated :)

[OskarStark]

Can you please rebase? Thanks

[nicolas-grekas]

LGTM with some comments thanks

[norkunas]

Maybe using Clock component optionally would be better with fallback, to allow using mock clock in tests for devs?

[BaptisteContreras]

It will create a dependency between HttpFoundation and the Clock component. How would you do it ?

[norkunas]

Require-dev? :)

[BaptisteContreras]

Mmmh I see, and in the check method I should get the current time like that ?

if (class_exists(\Symfony\Component\Clock\Clock::class)) {
            $time =  \Symfony\Component\Clock\Clock::get()->now()->format('U');
        } else {
            $time = time();
        }

[norkunas]

Probably. Or via DI, not sure what maintainers would prefer

[nicolas-grekas]

I wouldn't use the Clock component in this PR. Let's use time() for now and discuss for Clock applied to HttpFoundation separately

[BaptisteContreras]

@nicolas-grekas if this PR is OK for you, can we have this in 7.1 ?

[fabpot]

@BaptisteContreras Are you still interested in finishing this PR?

[BaptisteContreras]

@fabpot , yes ! I'm on it :)

[fabpot]

Thank you @BaptisteContreras.

[nicolas-grekas]

I missed that this is a BC break. Instead, we should comment the argument on the signature and read it with func_get_arg (see on 6.4 for similar new arguments).

[BaptisteContreras]

Is it a BC even if the default value does not change the old behavior of the method ?
Do you want another PR linked to a new issue to fix this ?

[nicolas-grekas]

It's a BC break for classes that extend this class. Yes, it'd be great to fix it, PR welcome :)