如何将Rails应用密码迁移至Laravel？PHP验证旧密码方法

Got it, let's break down how to handle this password migration smoothly—here's a step-by-step implementation that fits right into your Laravel workflow:

1. Add a Legacy Password Field First #

First, you'll need a dedicated column in your users table to store the old Rails passwords. Generate a migration with this command:

php artisan make:migration add_old_password_to_users_table

Open the generated migration file and add the nullable string field:

public function up()
{
    Schema::table('users', function (Blueprint $table) {
        $table->string('old_password')->nullable();
    });
}

public function down()
{
    Schema::table('users', function (Blueprint $table) {
        $table->dropColumn('old_password');
    });
}

Run the migration to apply the change:

php artisan migrate

Don't forget to add old_password to the $fillable array in your User model so you can mass-assign it when importing legacy data.

2. Modify Login Logic to Validate Legacy Passwords #

Rails uses bcrypt by default, and PHP's built-in password_verify() function is fully compatible with Rails' bcrypt hashes (even if they start with $2a$ or $2y$—PHP handles both variants seamlessly).

Override the attemptLogin method in your LoginController (usually at app/Http/Controllers/Auth/LoginController.php) to handle the legacy password check:

use Illuminate\Support\Facades\Hash;
use Illuminate\Http\Request;

protected function attemptLogin(Request $request)
{
    // Fetch the user by their email
    $user = \App\Models\User::where('email', $request->email)->first();

    // Check if the user has a legacy Rails password stored
    if ($user && $user->old_password) {
        // Verify the submitted password against the Rails hash
        if (password_verify($request->password, $user->old_password)) {
            // Migrate to Laravel's bcrypt hash
            $user->password = Hash::make($request->password);
            $user->old_password = null; // Clear the legacy field
            $user->save();

            // Log the user in
            $this->guard()->login($user, $request->filled('remember'));
            return true;
        }
        // Return failure if legacy password doesn't match
        return false;
    }

    // Fall back to Laravel's default login verification for users without legacy passwords
    return $this->guard()->attempt(
        $this->credentials($request), $request->filled('remember')
    );
}

3. Key Notes to Keep in Mind #

• Rails Hash Compatibility: Rails' default bcrypt hashes include all necessary metadata (cost factor, salt, and hash) right in the string—no extra parsing is needed for password_verify() to work.
• Field Length: The old_password field uses string() which is perfect because bcrypt hashes are always exactly 60 characters long.
• User Experience: Users won't notice any change—on their first successful login after migration, their password is automatically converted to Laravel's format, and the legacy field is cleared for future logins.

Once this setup is live, your migration will handle password conversion seamlessly for every user on their next login.

内容的提问来源于stack exchange，提问作者Federico JM