Skip to content

[RFC] Give back control of password hashing algorithm to app developer #33054

@teohhanhui

Description

@teohhanhui

Description
(From #30914 (comment), #30914 (comment), #30914 (comment))

I think what's still very disturbing to me is that the app developer will completely lose control over which password hashing algorithm to use.

What's worse, if you have a scenario where you upgrade your PHP version / sodium extension and a new algorithm becomes supported, then if you rollback the app, the password would then fail to verify. There is no way to prevent this from happening if the app developer is forced to use auto.

TL;DR: auto is a good default, but choice is good (and sometimes necessary).

Example

encoders:
    App\Entity\User:
        algorithm: argon2id

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions