Symfony5: isPasswordValid return true only with plain password

Viewed 228

I'm facing a weird issue that I've never met before with Symfony 5.2.

I'm implementing a login for an API, and it seems that the method of

UserPasswordEncoderInterface::isPasswordValid don't validate properly my password and returning false.

here is my encoder in security.yaml:

encoders:
    # use your user class name here
    App\Domain\Security\Models\User:
        # Use native password encoder
        # This value auto-selects the best possible hashing algorithm
        # (i.e. Sodium when available).
        algorithm: auto

My user creation:

$user = (new User())->setEmail($userData['email']);
$encodedPassword = $this->encoder->encodePassword($user, $userData['password']);
$user->setPassword($encodedPassword);
if (!empty($userData['roles'])) {
    $user->setRoles(explode(',', $userData['roles']));
}

return $user;

Then my user is saved properly in database:

MariaDB [blog]> select * from user\G
*************************** 1. row ***************************
      id: 5
   email: toto@toto.fr
password: $argon2id$v=19$m=65536,t=4,p=1$MmQySDNJSTJQUEoxTFFDbQ$Rb0A80bVnvLbXauc/1yU9DndH7v88b/LQ9ein6lBFKM
   roles: NULL
apiToken: NULL

Now when i'm login i'm checking the password as follow:

private function validatePasswordOrFail(string $userPassword, User $existingUser): void
    {
        if(!$this->encoder->isPasswordValid($existingUser, $userPassword))
        {
            LoginException::userNotFoundOrInvalidPassword();
        }
    }

Here I'm always going into my condition. after dumping, $existingUser is good, $userPassword is good.

The odd fact is that if i change the value of password in db, for a plain password like:

MariaDB [blog]> select * from user\G
*************************** 1. row ***************************
      id: 5
   email: toto@toto.fr
password: mypassword
   roles: NULL
apiToken: NULL

Now the isPasswordValid return true and I'm not going into my condition.

What I'm missing?

NB: My User implements the Symfony\Component\Security\Core\User\UserInterface and my method getSalt() is still empty

/**
 * @inheritDoc
 */
public function getSalt()
{
}

but in the past, I've always managed it this way and never encounter this problem.

1 Answers

I just figured it out.

I'm using a Factory to create my user.

It's this factory who encode password before setting it.

The fact is I also use this Factory into my Repository, so when i'm fetching my hashed password from database and creating a User, i'm re-hashing the hashed password...

Related