Create a custom rule instead php artisan make:rule PasswordRule
then use it in the validator
$request->validate([
'password' => ['required' , new \App\Rules\PasswordRule],
]);
Be part of JetBrains PHPverse 2026 on June 9 – a free online event bringing PHP devs worldwide together.
Background:
I opened this as an issue on the Jetstream repo, but they said it would be better to ask somewhere else.
Problem:
I'm using a non-laravel user provider (Active Directory via LdapRecord package) and therefore need a custom hook for confirming passwords:
// AuthServiceProvider
public function boot()
{
$this->registerPolicies();
// custom hook for confirming passwords
Fortify::confirmPasswordsUsing(function($user, $password) {
return Auth::validate([
'mail' => $user->email,
'password' => $password
]);
});
}
This works great for confirming passwords, but I found when the password is confirmed before account deletion the @destroy method on Interia's CurrentUserController uses the Validator password rule and not the custom hook. This causes validation to fail with the message the password is incorrect.
// Laravel\Jetstream\Http\Controllers\Inertia\CurrentUserController
public function destroy(Request $request, StatefulGuard $auth)
{
// this does not use the custom hook
// and the validation fails.
$request->validate([
'password' => 'required|string|password',
]);
...
}
I found a way to solve the issue, but it feels a little gross. I can substitute my own validator in AppServiceProvider by passing it in via the Validator@resolver method.
// AppServiceProvider
Validator::resolver( function($translator, $data, $rules, $messages, $customAttributes) {
return new App\Validation\Validator($translator, $data, $rules, $messages, $customAttributes);
});
Then I can override the @validateCurrentPassword method on my custom validator class
// App\Validation\Validator
protected function validateCurrentPassword($attribute, $password, $parameters)
{
Log::debug("Using custom validator");
return app(ConfirmPassword::class)(
Auth::guard(), Auth::user(), $password
);
}
It seems like there should be some consistency to how passwords are confirmed. Why does it allow a custom hook for other areas but then uses Laravel's validation rule for account deletion? Ideally any password confirmation should conform to a standard. I'm tempted to submit a PR to the repo, but I doubt it will get any traction unless others chime in with support.
Is there a better way to substitute the password validation rule to make it use a different method? Has anyone else run into this?
Thanks, -Jeremy
Please or to participate in this conversation.