Description
I'm questioning the entire section at https://symfony.com/doc/current/security/custom_authenticator.html#user-identifier, starting with:
It's a good practice to normalize the user identifier before using it.
@Spomky and @javiereguiluz you were the last ones who edited it.
Right now, this sounds like a recommendation to lowercase all email addresses. But this is no good advice IMO, since email addresses are case-sensitive, see https://stackoverflow.com/a/9808332/1668200
Besides, I cannot see the point of bringing up the gmail example. This creates the impression that even removing dots is the way to go ("If Google does it, then probably everybody else is doing it..."). However, we're in the context of using email addresses as usernames, and here gmail is just one provider, among millions of others.
So, frankly, I don't care what gmail is doing. And they might even change it tomorrow...
So I'm suggesting to reduce all this to just a short note - something like:
You can pass a custom normalizer (e.g. to lowercase the username).
Since everybody needs to decide for themselves what's best in their use case.
I didn't come up with a PR right away, since (more or less) deleting everything you just added, might look a bit harsh ;-)
Activity
Spomky commentedon Jun 13, 2025
Hi @ThomasLandauer,
Thanks a lot for your feedback.
Indeed, the section you referenced is meant to address user identifiers in general, not email addresses specifically.
The recommendation to normalize is about ensuring consistent comparisons during authentication, in particuar because identifiers come from user input.
You're also right about the Gmail example it should be removed to avoid confusion and unintended assumptions.
The
john.doe@acme.com
examples could be removed too for the same reason.wouterj commentedon Jun 13, 2025
I agree, we can probably simplify the section, only leaving something like this:
[Security]: Removing recommendations to lowercase email adresses
minor #21088 [Security] : Removing recommendations to lowercase email…