/service_container/3.3-di-changes https://symfony.com/doc/3.4/service_container/3.3-di-changes.html

/frontend/encore/shared-entry /frontend/encore/split-chunks

/testing/functional_tests_assertions /testing#testing-application-assertions

/security/named_encoders /security/named_hashers

This functionality is offered by the:class:`Symfony\\Component\\Security\\Core\\Authentication\\Provider\\DaoAuthenticationProvider`.

It fetches the user's data from a:class:`Symfony\\Component\\Security\\Core\\User\\UserProviderInterface`,

uses a:class:`Symfony\\Component\\Security\\Core\\Encoder\\PasswordEncoderInterface`

uses a:class:`Symfony\\Component\\PasswordHasher\\Hasher\\UserPasswordHasherInterface`

to create a hash of the password and returns an authenticated token if the

password was valid::

It is also possible to let multiple user providers try to find the user's

data, using the:class:`Symfony\\Component\\Security\\Core\\User\\ChainUserProvider`.

The Password Encoder Factory

.. _the-password-encoder-factory:

The Password Hasher Factory

The:class:`Symfony\\Component\\Security\\Core\\Authentication\\Provider\\DaoAuthenticationProvider`

usesan encoderfactory to create a passwordencoder for a given type of

user. This allowsyou to use differentencoding strategies for different

types of users.The default:class:`Symfony\\Component\\Security\\Core\\Encoder\\EncoderFactory`

receives an array ofencoders::

usesafactory to create a passwordhasher for a given type of user. This allows

you to use differenthashing strategies for different types of users.

The default:class:`Symfony\\Component\\PasswordHasher\\Hasher\\PasswordHasherFactory`

receives an array ofhashers::

Eachencoder should implement:class:`Symfony\\Component\\Security\\Core\\Encoder\\PasswordEncoderInterface`

Eachhasher should implement:class:`Symfony\\Component\\PasswordHasher\\Hasher\\UserPasswordHasherInterface`

or be an array with a ``class`` and an ``arguments`` key, which allows the

encoder factory to construct the encoder only when it is needed.

hasher factory to construct the hasher only when it is needed.

.. _creating-a-custom-password-encoder:

Creating a custom PasswordEncoder

Creating a custom PasswordHasher

There are many built-in passwordencoders. But if you need to create your

There are many built-in passwordhasher. But if you need to create your

own, it needs to follow these rules:

#. The class must implement:class:`Symfony\\Component\\Security\\Core\\Encoder\\PasswordEncoderInterface`

(you can also extend:class:`Symfony\\Component\\Security\\Core\\Encoder\\BasePasswordEncoder`);

#. The class must implement:class:`Symfony\\Component\\PasswordHasher\\Hasher\\UserPasswordHasherInterface`

(you can also extend:class:`Symfony\\Component\\PasswordHasher\\Hasher\\UserPasswordHasher`);

#. The implementations of

:method:`Symfony\\Component\\Security\\Core\\Encoder\\PasswordEncoderInterface::encodePassword`

:method:`Symfony\\Component\\PasswordHasher\\Hasher\\UserPasswordHasherInterface::hashPassword`

and

:method:`Symfony\\Component\\Security\\Core\\Encoder\\PasswordEncoderInterface::isPasswordValid`

:method:`Symfony\\Component\\PasswordHasher\\Hasher\\UserPasswordHasherInterface::isPasswordValid`

must first of all make sure the password is not too long, i.e. the password length is no longer

than 4096 characters. This is for security reasons (see `CVE-2013-5750`_), and you can use the

:method:`Symfony\\Component\\Security\\Core\\Encoder\\BasePasswordEncoder::isPasswordTooLong`

:method:`Symfony\\Component\\PasswordHasher\\Hasher\\CheckPasswordLengthTrait::isPasswordTooLong`

method for this check::

Using Password Encoders

.. _using-password-encoders:

When the:method:`Symfony\\Component\\Security\\Core\\Encoder\\EncoderFactory::getEncoder`

method of the password encoder factory is called with the user object as

its first argument, it will return an encoder of type:class:`Symfony\\Component\\Security\\Core\\Encoder\\PasswordEncoderInterface`

which should be used to encode this user's password::

Using Password Hashers

When the:method:`Symfony\\Component\\PasswordHasher\\Hasher\\PasswordHasherFactory::getPasswordHasher`

method of the password hasher factory is called with the user object as

its first argument, it will return a hasher of type:class:`Symfony\\Component\\PasswordHasher\\PasswordHasherInterface`

which should be used to hash this user's password::

Authentication Events