-

Author: javiereguiluz

security.rst

@@ -343,11 +343,6 @@ can also create your own :ref:`custom user provider <security-custom-user-provid
     it using the :class:`Symfony\\Component\\Security\\Core\\User\\UserProviderInterface`
     type-hint.
 
-.. note::
-
-    The maximum length allowed for the user identifier is 4096 characters to
-    prevent `session storage flooding`_ attacks.
-
 .. _security-encoding-user-password:
 
 Registering the User: Hashing Passwords
@@ -2661,4 +2656,3 @@ Authorization (Denying Access)
 .. _`SymfonyCastsVerifyEmailBundle`: https://github.com/symfonycasts/verify-email-bundle
 .. _`HTTP Basic authentication`: https://en.wikipedia.org/wiki/Basic_access_authentication
 .. _`Login CSRF attacks`: https://en.wikipedia.org/wiki/Cross-site_request_forgery#Forging_login_requests
-.. _`session storage flooding`: https://symfony.com/blog/cve-2016-4423-large-username-storage-in-session

security/custom_authenticator.rst

@@ -205,6 +205,11 @@ using :ref:`the user provider <security-user-providers>`::
     // ...
     $passport = new Passport(new UserBadge($email), $credentials);
 
+.. note::
+
+    The maximum length allowed for the user identifier is 4096 characters to
+    prevent `session storage flooding`_ attacks.
+
 .. note::
 
     You can optionally pass a user loader as second argument to the
@@ -373,3 +378,5 @@ authenticator methods (e.g. ``createToken()``)::
             return new CustomOauthToken($passport->getUser(), $passport->getAttribute('scope'));
         }
     }
+
+.. _`session storage flooding`: https://symfony.com/blog/cve-2016-4423-large-username-storage-in-session