Description
Symfony version(s) affected: 4.4.1
Description
Using the form_login
authentification provider with a database user provider, got an error when login with a user with a null password (in the entity/database) :
Argument 1 passed to Symfony\Component\Security\Core\Encoder\NativePasswordEncoder::needsRehash() must be of the type string, null given, called in ...\vendor\symfony\security-core\Encoder\MigratingPasswordEncoder.php on line 51
This works in Symfony 4.1.
How to reproduce
Create an application with
- A User Entity
- A form and a controller for login
- Configure security
security:
encoders:
App\Entity\User:
algorithm: 'bcrypt'
providers:
our_db_provider:
entity:
class: App\Entity\User
firewalls:
main:
anonymous: true
form_login:
login_path: login
check_path: login
provider: our_db_provider
- Add a user with an empty password
- Try to authenticate with this user
Possible Solution
Make parameter $encoded
nullable in Symfony\Component\Security\Core\Encoder\NativePasswordEncoder::needsRehash()
Additional context
In my case I have null password because some users are authenticate with the form_login
(password is in the User entity) others are authenticate with form_login_ldap
(in this case the password is null in the User entity).