Skip to content

Commit ff71522

Browse files
nicolas-grekasnicolas-grekas
committed
[Security] add password rehashing capabilities
1 parent 04de8fe commit ff71522

File tree

11 files changed

+134
-2
lines changed

11 files changed

+134
-2
lines changed

‎src/Symfony/Bundle/SecurityBundle/DependencyInjection/SecurityExtension.php

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -558,6 +558,8 @@ private function createEncoder($config, ContainerBuilder $container)
558558

559559
// bcrypt encoder
560560
if ('bcrypt' === $config['algorithm']) {
561+
@trigger_error('Configuring an encoder with "bcrypt" as algorithm is deprecated since Symfony 4.4, use "auto" instead.', E_USER_DEPRECATED);
562+
561563
return [
562564
'class' => 'Symfony\Component\Security\Core\Encoder\BCryptPasswordEncoder',
563565
'arguments' => [$config['cost'] ?? 13],

‎src/Symfony/Component/Security/CHANGELOG.md

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,14 @@
11
CHANGELOG
22
=========
33

4+
4.4.0
5+
-----
6+
7+
* Added `ChainPasswordEncoder`
8+
* Added method `PasswordEncoderInterface::needsRehash()`
9+
* Added method `UserProviderInterface::upgradePassword()`
10+
* Deprecated `BCryptPasswordEncoder`, use `NativePasswordEncoder` instead
11+
412
4.3.0
513
-----
614

‎src/Symfony/Component/Security/Core/Authentication/Provider/DaoAuthenticationProvider.php

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,13 +30,15 @@ class DaoAuthenticationProvider extends UserAuthenticationProvider
3030
{
3131
private $encoderFactory;
3232
private $userProvider;
33+
private $canUpgradePassword;
3334

3435
public function __construct(UserProviderInterface $userProvider, UserCheckerInterface $userChecker, string $providerKey, EncoderFactoryInterface $encoderFactory, bool $hideUserNotFoundExceptions = true)
3536
{
3637
parent::__construct($userChecker, $providerKey, $hideUserNotFoundExceptions);
3738

3839
$this->encoderFactory = $encoderFactory;
3940
$this->userProvider = $userProvider;
41+
$this->canUpgradePassword = method_exists($userProvider, 'upgradePassword');
4042
}
4143

4244
/**
@@ -54,9 +56,15 @@ protected function checkAuthentication(UserInterface $user, UsernamePasswordToke
5456
throw new BadCredentialsException('The presented password cannot be empty.');
5557
}
5658

57-
if (!$this->encoderFactory->getEncoder($user)->isPasswordValid($user->getPassword(), $presentedPassword, $user->getSalt())) {
59+
$encoder = $this->encoderFactory->getEncoder($user);
60+
61+
if (!$encoder->isPasswordValid($user->getPassword(), $presentedPassword, $user->getSalt())) {
5862
throw new BadCredentialsException('The presented password is invalid.');
5963
}
64+
65+
if ($this->canUpgradePassword && method_exists($encoder, 'needsRehash') && $encoder->needsRehash($user->getPassword())) {
66+
$this->userProvider->upgradePassword($user, $encoder->encodePassword($presentedPassword, $user->getSalt()));
67+
}
6068
}
6169
}
6270

‎src/Symfony/Component/Security/Core/Encoder/BCryptPasswordEncoder.php

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,11 +11,15 @@
1111

1212
namespace Symfony\Component\Security\Core\Encoder;
1313

14+
@trigger_error(sprintf('The "%s" class is deprecated since Symfony 4.4, use "%s" instead.', BCryptPasswordEncoder::class, NativePasswordEncoder::class), E_USER_DEPRECATED);
15+
1416
use Symfony\Component\Security\Core\Exception\BadCredentialsException;
1517

1618
/**
1719
* @author Elnur Abdurrakhimov <elnur@elnur.pro>
1820
* @author Terje Bråten <terje@braten.be>
21+
*
22+
* @deprecated since Symfony 4.4, use NativePasswordEncoder instead
1923
*/
2024
class BCryptPasswordEncoder extends BasePasswordEncoder implements SelfSaltingEncoderInterface
2125
{

‎src/Symfony/Component/Security/Core/Encoder/BasePasswordEncoder.php

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,14 @@ abstract class BasePasswordEncoder implements PasswordEncoderInterface
2020
{
2121
const MAX_PASSWORD_LENGTH = 4096;
2222

23+
/**
24+
* {@inheritdoc}
25+
*/
26+
public function needsRehash(string $encoded): bool
27+
{
28+
return false;
29+
}
30+
2331
/**
2432
* Demerges a merge password and salt string.
2533
*

‎src/Symfony/Component/Security/Core/Encoder/ChainPasswordEncoder.php

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
<?php
2+
3+
/*
4+
* This file is part of the Symfony package.
5+
*
6+
* (c) Fabien Potencier <fabien@symfony.com>
7+
*
8+
* For the full copyright and license information, please view the LICENSE
9+
* file that was distributed with this source code.
10+
*/
11+
12+
namespace Symfony\Component\Security\Core\Encoder;
13+
14+
/**
15+
* Hashes passwords using the best available encoder.
16+
* Validates them using a chain of encoders.
17+
*
18+
* @author Nicolas Grekas <p@tchwork.com>
19+
*/
20+
final class ChainPasswordEncoder extends BasePasswordEncoder implements SelfSaltingEncoderInterface
21+
{
22+
private $bestEncoder;
23+
private $extraEncoders;
24+
25+
public function __construct(PasswordEncoderInterface $bestEncoder, PasswordEncoderInterface ...$extraEncoders)
26+
{
27+
$this->bestEncoder = $bestEncoder;
28+
$this->extraEncoder = $extraEncoder;
29+
}
30+
31+
/**
32+
* {@inheritdoc}
33+
*/
34+
public function encodePassword($raw, $salt)
35+
{
36+
return $this->bestEncoder->encodePassword($raw, $salt);
37+
}
38+
39+
/**
40+
* {@inheritdoc}
41+
*/
42+
public function isPasswordValid($encoded, $raw, $salt)
43+
{
44+
if ($this->bestEncoder->isPasswordValid($encoded, $raw, $salt)) {
45+
return true;
46+
}
47+
48+
foreach ($this->extraEncoders as $encoder) {
49+
if ($encoder->isPasswordValid($encoded, $raw, $salt)) {
50+
return true;
51+
}
52+
}
53+
54+
return false;
55+
}
56+
57+
/**
58+
* {@inheritdoc}
59+
*/
60+
public function needsRehash(string $encoded): bool
61+
{
62+
return $this->bestEncoder->needsRehash($encoded);
63+
}
64+
}

‎src/Symfony/Component/Security/Core/Encoder/EncoderFactory.php

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -85,7 +85,16 @@ private function createEncoder(array $config)
8585
private function getEncoderConfigFromAlgorithm($config)
8686
{
8787
if ('auto' === $config['algorithm']) {
88-
$config['algorithm'] = SodiumPasswordEncoder::isSupported() ? 'sodium' : 'native';
88+
$encoderChain = [];
89+
foreach ([SodiumPasswordEncoder::isSupported() ? 'sodium' : 'native', 'pbkdf2', $config['hash_algorithm'], 'plaintext'] as $algo) {
90+
$config['algorithm'] = $algo;
91+
$encoderChain[] = $this->createEncoder($config);
92+
}
93+
94+
return [
95+
'class' => ChainPasswordEncoder::class,
96+
'arguments' => $encoderChain,
97+
];
8998
}
9099

91100
switch ($config['algorithm']) {
@@ -106,6 +115,7 @@ private function getEncoderConfigFromAlgorithm($config)
106115
],
107116
];
108117

118+
/* @deprecated since Symfony 4.4 */
109119
case 'bcrypt':
110120
return [
111121
'class' => BCryptPasswordEncoder::class,

‎src/Symfony/Component/Security/Core/Encoder/NativePasswordEncoder.php

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -89,4 +89,12 @@ public function isPasswordValid($encoded, $raw, $salt)
8989

9090
return \strlen($raw) <= self::MAX_PASSWORD_LENGTH && password_verify($raw, $encoded);
9191
}
92+
93+
/**
94+
* {@inheritdoc}
95+
*/
96+
public function needsRehash(string $encoded): bool
97+
{
98+
return password_needs_rehash($encoded, $this->algo, $this->options);
99+
}
92100
}

‎src/Symfony/Component/Security/Core/Encoder/PasswordEncoderInterface.php

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,8 @@
1717
* PasswordEncoderInterface is the interface for all encoders.
1818
*
1919
* @author Fabien Potencier <fabien@symfony.com>
20+
*
21+
* @method bool needsRehash(string $encoded)
2022
*/
2123
interface PasswordEncoderInterface
2224
{

‎src/Symfony/Component/Security/Core/Encoder/SodiumPasswordEncoder.php

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -94,4 +94,20 @@ public function isPasswordValid($encoded, $raw, $salt)
9494

9595
throw new LogicException('Libsodium is not available. You should either install the sodium extension, upgrade to PHP 7.2+ or use a different encoder.');
9696
}
97+
98+
/**
99+
* {@inheritdoc}
100+
*/
101+
public function needsRehash(string $encoded): bool
102+
{
103+
if (\function_exists('sodium_crypto_pwhash_str_needs_rehash')) {
104+
return \sodium_crypto_pwhash_str_needs_rehash($encoded, $this->opsLimit, $this->memLimit);
105+
}
106+
107+
if (\extension_loaded('libsodium')) {
108+
return \Sodium\crypto_pwhash_str_needs_rehash($encoded, $this->opsLimit, $this->memLimit);
109+
}
110+
111+
throw new LogicException('Libsodium is not available. You should either install the sodium extension, upgrade to PHP 7.2+ or use a different encoder.');
112+
}
97113
}

0 commit comments

Comments
 (0)
pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy