Laravel Fortify Password Reset: Login Issue

Hello everyone,

I'm encountering a login issue in my Laravel application when users reset their passwords using Laravel Fortify's password reset functionality.

Here's the problem:

When a user forgets their password and goes through the password reset process, everything seems to work fine. They receive the password reset email, set a new password in the reset form, and receive confirmation that their password has been updated.
However, when they try to log in with the new password, the login fails. It's as if the new password isn't being recognized by the authentication system.

I suspect that the issue might be related to how passwords are hashed during the password reset process. Currently, I'm using the following setPasswordAttribute method in my User model to hash passwords:

public function setPasswordAttribute($value)
    {
        $this->attributes['password'] = Hash::make($value);
    }

I'm wondering if this method might be causing conflicts during the password reset process, where passwords are already hashed by Laravel Fortify before being saved to the database.

Has anyone else encountered a similar issue with Laravel Fortify's password reset functionality? Are there any specific considerations or best practices I should follow when handling password hashing in this scenario?

Any insights or suggestions would be greatly appreciated. Thank you!

Snapey

2 years ago

Best Answer

Level 122

its easy to find out

in the setPassword function you showed, just store password (no hash)

Go through the user reset password

Look in the database. Is the user password stored in plain text, in which case you are right to hash, If the password is still hashed then you are double hashing. You may now be able to login?

jhyaps

2 years ago

Level 1

@Snapey, you're absolutely correct. The issue in my case stemmed from double hashing the password. Initially, during the password reset process, Laravel Fortify actions automatically hash the password within the reset method

public function reset(User $user, array $input): void
    {
        Validator::make($input, [
            'password' => $this->passwordRules(),
        ])->validate();

        $user->forceFill([
            'password' => Hash::make($input['password']),
        ])->save();
    }

However, I had also implemented a mutator for the password field, which further hashed the password value. To resolve this, I revised the mutator as follows:

public function setPasswordAttribute($value)
    {
        // Check if the given password is already hashed
        if (Hash::needsRehash($value)) {
            // If it is not hashed, hash it before setting the attribute
            $this->attributes['password'] = Hash::make($value);
        } else {
            // If it is already hashed, don't hash it again
            $this->attributes['password'] = $value;
        }
    }

This approach ensures that passwords are hashed only when necessary, preventing double hashing and login issues. However, I'm curious if there's a more optimal solution or if there are any best practices to handle this scenario.

Any insights or suggestions would be greatly appreciated. Thank you!

Please or to participate in this conversation.