Don't store the password in the session after logging in

[nicolas-grekas]

Related to symfony/symfony#59106

I'm wondering why we don't have the User object this way: aka why do we need a serialize function? And why don't we erase the password? Yes it's hashed, but removing it is still better to me.

Anything I'm missing?
@chalasr @stof maybe?

[chalasr]

I think symfony/symfony#59106 (comment) invalidates this

[nicolas-grekas]

Nah symfony/symfony#59106 (comment)

[stof]

Another valid reason to use __serialize is that a real-world project might have additional relations in their User entity (for other reasons that the authentication) and you would not want to have all of them included in the serialized payload (which might even trigger initialization of proxies depending on whether serialization triggers it or no).
And if serialization does not automatically triggers the initialization of proxies, you would need this __serialize performing property access that would ensure that Doctrine initializes the proxy.

[nicolas-grekas]

This would require symfony/symfony#59539