[LiveComponent] Use container.build_hash instead of kernel.secret in CacheWarmer

[dkarlovi]

Q	A
Bug fix?	yes
New feature?	no
Issues	Fix #2419
License	MIT

[smnandre]

Nice if this solution works for everyone!

Depending on the feedback people give, we should probably add some tests to prevent problems in the future.

[smnandre]

Should we do the same for the FingerprintCalculator / Hydrator ?

(they should only be called on runtime)

[dkarlovi]

AFAIK, they are actually using the secret as intended? The secret is required for cryptography there? I might be mistaken, feel free to correct me.

Edit: correct, I've checked it and the secret usage there is indeed cryptographic and correct. I've actually reverse engineered this specific part of code in a Node app (to enable the Node app to render correct live components), it must use the secret too (the secret is shared with the Node app). It would be cool if you could specific a LiveComponent-specific secret (so, not use kernel.secret) to improve the security, but that's not something we should do in this PR. @smnandre

[smnandre]

Can you add a line in the changelog ?

[dkarlovi]

@smnandre done.

[smnandre]

Thank you @dkarlovi.

[dkarlovi]

@smnandre IMO a bugfix release with this would be in order since it's blocking using Symfony 7.2 in specific cases completely.