Skip to content

Navigation Menu

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Appearance settings

[SecurityBundle] register alias for argument for password hasher #60371

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: 7.3
Choose a base branch
Loading
from

Conversation

lyrixx
Copy link
Member

@lyrixx lyrixx commented May 7, 2025

Q A
Branch? 7.3
Bug fix? no
New feature? yes
Deprecations? no
Issues
License MIT

This is a new feature, but I want to gather feedback before finishing the PR (meta + doc + test)

I need to hash some sensitive data in my database (2FA recovery code).
They are not tied to a specific class. So I need a "raw hasher".

ATM, I'm able to write:

security:
    password_hashers:
        Symfony\Component\Security\Core\User\PasswordAuthenticatedUserInterface: 'auto'
        recovery_code: auto

But to get it, I need to write:

    public function homepage(PasswordHasherFactoryInterface $p): Response
    {
        $password = 'password';
        $hash = $p->getPasswordHasher('recovery_code')->hash($password);
        dd($hash);

There is an extra steps here (low of demeter...)

With this PR, I propose an alternative:

class HomepageController extends AbstractController
{
    public function __construct(
        #[Target('recovery_code')]
        private readonly PasswordHasherInterface $passwordHasher,
    ) {
    }

    #[Route('/')]
    public function index(): Response
    {
        dd($this->passwordHasher->hash('aaa'));

DX is extra smooth. If I forgot the Target Attribute:

image

@lyrixx lyrixx force-pushed the security-password-hasher branch from 2216356 to 576f604 Compare May 14, 2025 09:10
@lyrixx
Copy link
Member Author

lyrixx commented May 14, 2025

@nicolas-grekas I addressed your comments, added tests, and updated CHANGELOG.md

@lyrixx lyrixx force-pushed the security-password-hasher branch from 576f604 to 9b50bc9 Compare May 14, 2025 09:11
@lyrixx lyrixx force-pushed the security-password-hasher branch from 9b50bc9 to c6051e3 Compare May 14, 2025 09:38
Copy link
Member

@chalasr chalasr left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Great 👍

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants
Morty Proxy This is a proxified and sanitized view of the page, visit original site.