New in Symfony 5.3: PasswordHasher Component
April 29, 2021 • Published by Javier Eguiluz
Symfony 5.3 is backed by:
Warning: This post is about an unsupported Symfony version. Some of this information may be out of date. Read the most recent Symfony Docs.
Contributed by
Robin Chalas
in #39802.
Hashing passwords is the process of applying a cryptographic hash function to transform the original plain text password into a different non-guessable value which is infeasible to invert.
For historical reasons, Symfony uses the term "password encoding" when it should really refer to "password hashing". This has caused some confusion for people learning Symfony, so we decided to fix this in Symfony 5.3 for once and for all.
That's why in Symfony 5.3 we're introducing a new component called PasswordHasher. This component extracts all the existing code and features related to "password encoding" and renames it to "password hashing". All the "encoding" features are deprecated in Symfony 5.3 and will be removed in Symfony 6.0.
The API of the new hasher is similar to the previous one and slightly more close to the PHP built-in password hashing API:
1 2 3 4 5 6 7 8 9 10
namespace Symfony\Component\PasswordHasher;
interface PasswordHasherInterface
{
public function hash(string $plainPassword): string;
public function verify(string $hashedPassword, string $plainPassword): bool;
public function needsRehash(string $hashedPassword): bool;
}
This new component can be used independently from the rest of Symfony features in any PHP application. For existing Symfony applications, the new component is included automatically when installing/updating the security package, so you don't need to make any change in your dependencies.
The impact in your application code will be low, but you might need to make some
minor changes. For example, the security:encode-password
command is now
called security:hash-password
. The security.password_encoder
service is
now called security.password_hasher
, the UserPasswordEncoderInterface
is now UserPasswordHasherInterface
, etc.
The main change will be in the security configuration, where you need to replace
encoders
by password_hashers
:
1 2 3 4 5
# config/packages/security.yaml
-encoders:
+password_hashers:
App\Entity\User:
algorithm: 'auto'
Help the Symfony project!
As with any Open-Source project, contributing code or documentation is the most common way to help, but we also have a wide range of sponsoring opportunities.
Comments are closed.
To ensure that comments stay relevant, they are closed for old posts.
Good question. Actually, not all hash functions are suitable for hashing passwords. For example, BLAKE 3 is not.