Symfony无loginAction时，登录校验如何添加注册时的密码盐值

Got it, let's break this down. Since you're using Symfony's login_check endpoint (which relies on the security component under the hood) and need to replicate the same salted password logic from registration during authentication, here's exactly what you need to do:

First, let's align on the core problem: your registration flow manually adds a salt to the password before hashing, stores both the hashed password and salt on the User entity, and now you need Symfony's authentication system to apply that exact salt logic when verifying login credentials via login_check.

1. Update Your User Entity #

Make sure your User class implements PasswordAuthenticatedUserInterface and exposes the stored salt via the getSalt() method. If you haven't already, add a $salt property to persist the registration-generated salt:

// src/Entity/User.php
namespace App\Entity;

use Doctrine\ORM\Mapping as ORM;
use Symfony\Component\Security\Core\User\PasswordAuthenticatedUserInterface;
use Symfony\Component\Security\Core\User\UserInterface;

#[ORM\Entity(repositoryClass: UserRepository::class)]
class User implements UserInterface, PasswordAuthenticatedUserInterface
{
    // ... existing properties (id, email, roles, etc.)

    #[ORM\Column(length: 255)]
    private ?string $password = null;

    #[ORM\Column(length: 255)]
    private ?string $salt = null; // Stores the salt generated during registration

    // ... Getters and setters for password and salt

    public function getSalt(): ?string
    {
        return $this->salt; // Return the stored salt for authentication
    }

    public function getPassword(): ?string
    {
        return $this->password;
    }

    // Implement required UserInterface methods
    public function getUserIdentifier(): string
    {
        return (string) $this->email; // Use your login field (email/username)
    }

    public function getRoles(): array
    {
        return ['ROLE_USER']; // Adjust based on your role setup
    }

    public function eraseCredentials(): void
    {
        // Optional: Clear temporary sensitive data if needed
    }
}

2. Create a Custom Password Hasher #

Symfony's default hashers don't handle manual salt concatenation out of the box, so you'll build a custom one that mirrors your registration logic. This hasher will take the plaintext login password, combine it with the user's stored salt (in the same way you did during registration), then hash and compare it to the stored password.

// src/Security/CustomSaltedPasswordHasher.php
namespace App\Security;

use Symfony\Component\PasswordHasher\Exception\InvalidPasswordException;
use Symfony\Component\PasswordHasher\Hasher\PasswordHasherInterface;

class CustomSaltedPasswordHasher implements PasswordHasherInterface
{
    // Replace with the exact hash algorithm you used during registration
    private const HASH_ALGORITHM = 'bcrypt';

    public function hashPassword(string $plainPassword, ?string $salt = null): string
    {
        // Replicate your registration salt logic here
        // Example: If you did $passwordToHash = $plainPassword . $salt during registration
        $passwordWithSalt = $plainPassword . $salt;

        // Hash using your chosen algorithm
        return password_hash($passwordWithSalt, self::HASH_ALGORITHM);
    }

    public function verify(string $hashedPassword, string $plainPassword, ?string $salt = null): bool
    {
        // Apply the same salt logic to the login password
        $passwordWithSalt = $plainPassword . $salt;

        // Check if the hashes match
        if (!password_verify($passwordWithSalt, $hashedPassword)) {
            throw new InvalidPasswordException('Invalid credentials.');
        }

        // Optional: Trigger rehash if your algorithm has changed
        if (password_needs_rehash($hashedPassword, self::HASH_ALGORITHM)) {
            throw new InvalidPasswordException('Password needs to be rehashed.');
        }

        return true;
    }

    public function needsRehash(string $hashedPassword): bool
    {
        return password_needs_rehash($hashedPassword, self::HASH_ALGORITHM);
    }
}

Critical: Ensure the $passwordWithSalt logic exactly matches your registration flow (e.g., if you prepended the salt instead of appending, use $salt . $plainPassword instead).

3. Configure Symfony Security to Use Your Custom Hasher #

Update your config/packages/security.yaml to tell Symfony's security system to use your custom hasher for your User entity:

# config/packages/security.yaml
security:
    password_hashers:
        App\Entity\User:
            id: App\Security\CustomSaltedPasswordHasher

    firewalls:
        main:
            pattern: ^/api
            stateless: true # Ideal for API + React setups
            json_login:
                check_path: /api/login_check # Your login_check endpoint
                username_path: email # Match the login field your React app sends
                password_path: password
            # ... other firewall settings (logout, etc.)

    # ... Additional security config (access control, role hierarchies)

4. Verify the Authentication Flow #

When a user logs in via your React app:

1. React sends a POST request to /api/login_check with a JSON body like {"email": "user@example.com", "password": "plaintextpassword"}
2. Symfony's json_login listener extracts the credentials
3. It fetches the corresponding User entity from your database
4. It uses your CustomSaltedPasswordHasher to apply the stored salt to the plaintext password, hash it, and compare it to the stored hashed password
5. If matches, it generates an authentication token (JWT if using LexikJWTAuthenticationBundle, or session cookie if not stateless)

Key Notes #

• If you're using JWT (common for React+Symfony API setups), your LexikJWTAuthenticationBundle config will work seamlessly with this custom hasher – it plugs into Symfony's core authentication flow.
• Avoid weak hash algorithms like MD5 or SHA-1. Stick to bcrypt, argon2i, or argon2id (adjust the HASH_ALGORITHM constant accordingly).
• If you didn't manually generate the salt during registration (e.g., used Symfony's old auto-salt PasswordEncoder), you might not need a custom hasher – but since you explicitly mentioned manual salt addition, the above steps are necessary.

内容的提问来源于stack exchange，提问作者user9403257