Skip to content

[security] Error when calling needsRehash() with null password #34824

Closed
@etiennerousseau

Description

@etiennerousseau

Symfony version(s) affected: 4.4.1

Description
Using the form_login authentification provider with a database user provider, got an error when login with a user with a null password (in the entity/database) :

Argument 1 passed to Symfony\Component\Security\Core\Encoder\NativePasswordEncoder::needsRehash() must be of the type string, null given, called in ...\vendor\symfony\security-core\Encoder\MigratingPasswordEncoder.php on line 51

This works in Symfony 4.1.

How to reproduce
Create an application with

  • A User Entity
  • A form and a controller for login
  • Configure security
security:
    encoders:
        App\Entity\User:
            algorithm: 'bcrypt'
   providers:
        our_db_provider:
            entity:
                class: App\Entity\User 
   firewalls:
        main:
            anonymous: true
            form_login:
                login_path: login
                check_path: login
            provider: our_db_provider
  • Add a user with an empty password
  • Try to authenticate with this user

Possible Solution
Make parameter $encoded nullable in Symfony\Component\Security\Core\Encoder\NativePasswordEncoder::needsRehash()

Additional context
In my case I have null password because some users are authenticate with the form_login (password is in the User entity) others are authenticate with form_login_ldap (in this case the password is null in the User entity).

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions