passwordEncoder generated hash for non-authentication purpose fails on verification

问题

For a user to register with my system, I'm sending a confirmation mail with a generated link. On click the system should set an active property to true.

To create the confirm link, I generate a md5 hashed random_byte value. This value is part of the link I send to the user. The value is hashed with the passwordEncoder and stored in my database.

When the user clicks the link, the system checks the value against the hash in my database and should return true, to fully activate the user. For some reason the verification fails.

I checked, that the generated $identifier value in register() is the one that gets send to the user. They match. So no mistake there.

At first I wanted to use password_verify() only, but that didn't work out either.

I simply have no clue, why it's not working. My last guess is, that there is some Symfony dark magic going on, that I'm not aware of.

public function register(EntityManagerInterface $entityManager, Request $request, UserPasswordEncoderInterface $passwordEncoder, MailerInterface $mailer)
{
    // Register-Form
    $form = $this->createForm(RegisterFormType::class);

    $form->handleRequest($request);
    if ($form->isSubmitted() && $form->isValid()) {

        /** @var User $user */
        $user = $form->getData();

        $user->setPassword($passwordEncoder->encodePassword(
            $user,
            $form['plainPassword']->getData()
        ));

        // create activation hash
        $identifier = md5(random_bytes(16));

        $user->setActiveHash(
            $passwordEncoder->encodePassword(
                $user,
                $identifier
            )
        );


        // send activation mail with activation hash
        $message = (new TemplatedEmail())
            ->subject('...')
            ->from('...')
            ->to($user->getEmail())
            ->textTemplate('emails/registration.txt.twig')
            ->context([
                'mail' => $user->getEmail(),
                'identifier' => $identifier,
            ])
        ;

        $mailer->send($message);

        // persist & flush
        $entityManager->persist($user);
        $entityManager->flush();

        $this->addFlash('success', '...');

        //return $this->redirectToRoute('login');
        return $this->render('home/index.html.twig');
    }

    return $this->render('security/register.html.twig', [
        'registerForm' => $form->createView()
    ]);

}


/**
 * @Route("/confirm/{email}/{identifier}", name="register.confirm")
 */
public function confirm($email, $identifier, EntityManagerInterface $entityManager, UserPasswordEncoderInterface $passwordEncoder)
{
    $user = $entityManager->getRepository(User::class)->findOneBy([
        'email' => $email,
        'active' => false
    ]);

    if (!$user) {
        // fail no user with email
        die('no such user');
    }

    if( !$passwordEncoder->isPasswordValid($user, $identifier) ){
        // Hash verification failed
        die('hash failed');
    }

    $user->setActive(true);

    $entityManager->persist($user);
    $entityManager->flush();

    $this->addFlash('success', '...');

    return $this->redirectToRoute('login');

}

EDIT: I tried manually hashing a string with password_hash('a_string', PASSWORD_ARGON2ID) and it throws an exception that PASSWORD_ARGON2ID is an undefined constant. PASSWORD_ARGON2I works. And Symfony somehow uses Argon2ID as my password strings and the activeHash strings generated through encodePassword() start with "$argon2id..." How is that possible?

回答1:

Ok. So I was running PHP 7.2 via MAMP locally. As (before it was deleted) mentioned in the comments by msg, Argon2ID hashing was probably provided by Sodium. 7.2 password_verify() on the other hand was not able to verify a argon2id hash.

Upgraded to PHP 7.3.7 and no problem anymore.

来源：https://stackoverflow.com/questions/57648624/passwordencoder-generated-hash-for-non-authentication-purpose-fails-on-verificat

标签

symfony

symfony4