[6.x] – Override default EloquentUserProvider
to check $user->authPassword before checking hashes match
#367
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Resolves #366
The problem is that when ever anyone has "registered" with a provider, the
users.password
field is set toNULL
in the database. Therefore attempting to authenticate a user with their email and password throws an error exception, presenting itself as a 500 server error.The default eloquent user provider (rightly) assumes that the
user.password
column is always filled with a password hash (as is the default behaviour of every Laravel app). This results in the underlying hasher checking a hashed password from the form againstNULL
, which throws the error.The fix here is to override the
eloquent
user provider with our own user provider. This provider onlyextends
the base one and only overrides the methods that matter (in this case only thevalidateCredentials
method).