According tothe docs, settingpassword_hashers.xxx.algorithm=auto should prefer Sodium to native (bcrypt) if available:

it tries to use Sodium by default and falls back to the bcrypt password hashing function if not possible.

But this is not what's actually happening. New passwords are hashed with bcrypt ($2y$) instead of Argon2ID ($argon2id$). TheMigratingPasswordHasher gets an instance ofNativePasswordHasher instead ofSodiumPasswordHasher as first parameter ($bestHasher).

I think this is a simple mixup and the fix seems easy enough.

But I haven't found a good way to write a test for it:

• I can't get the "best hasher" out of theMigratingPasswordHasherto run an assertion on it
• PasswordHasherFactory::getHasherConfigFromAlgorithm is private, otherwise I could simply test its output

I'm open for ideas. Or can we merge the fix without a test?