4

I'm trying to implement authentication in laravel 4

When the user registers, I hash the password and save it, like this:

$password = Hash::make(Input::get('password'));

Then when the user tries to login, I want to authenticate him/her with the following code:

if (Auth::attempt(array('username' => Input::get('username'), 'password' => Hash::make(Input::get('password')))))
{
    return Redirect::intended('dashboard');
}

and that never succeeds. I tried to debug the code and it seems that the Hash::make function always gives a different result.

Am I using a good authentication methods?

4
  • 4
    Yes, Hash gives different results everytime. Use Hash::check($plain, $hashed) to compare. And like in the answer, don't use hasher in Auth::attempt method Jun 24, 2014 at 21:04
  • 2
    Hash::make() will give different results every time you execute it, because it uses a different salt every time.... that's why it's more secure than hashing with a fixed salt.... that's why you have Hash::check() as well
    – Mark Baker
    Jun 24, 2014 at 21:04
  • @MarkBaker good information, thanks Jun 24, 2014 at 21:09
  • @deczo did you meant the same as the first answer ? Jun 24, 2014 at 21:09

3 Answers 3

4

Don't Hash the password you are giving to the Auth::attempt method, it should be like this:

Auth::attempt(array('username' => Input::get('username'), 'password' => Input::get('password')));

You may also check the password using Hash::check('password', $hashedPassword). Read more about security on Laravel website.

3

Do not hash the password in the auth::attempt() function the code should be like this:

Auth::attempt(array('username' => Input::get('username'), 'password' => Input::get('password')));

The auth::attempt() will hash the password and then check if it matches the one stored in the database

0
1

To add some explanation to the answer, it is different every time because the hashing algorithm bcrypt generates a random string (salt) that has to be used to decrypt the password.

This is to protect passwords from rainbow table attacks. https://en.wikipedia.org/wiki/Rainbow_table

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.