From e95c1f5fac6d94d8a708d2cd200104201acd1225 Mon Sep 17 00:00:00 2001 From: Philipp Rieber Date: Sun, 23 Feb 2014 22:16:17 +0100 Subject: [PATCH] [Security][Authentication] Fix instructions for creating custom password encoders --- components/security/authentication.rst | 34 +++++++++++++++++++++++--- 1 file changed, 30 insertions(+), 4 deletions(-) diff --git a/components/security/authentication.rst b/components/security/authentication.rst index b06e0e24032..8a3b93a32ce 100644 --- a/components/security/authentication.rst +++ b/components/security/authentication.rst @@ -198,10 +198,36 @@ own, it just needs to follow these rules: #. The class must implement :class:`Symfony\\Component\\Security\\Core\\Encoder\\PasswordEncoderInterface`; -#. The first line in ``encodePassword`` and ``isPasswordValid`` must check - to make sure the password is not too long (e.g. 4096). This is for security - (see `CVE-2013-5750`_), and you can copy the `BasePasswordEncoder::checkPasswordLength`_ - implementation from Symfony 2.4. +#. The implementations of + :method:`Symfony\\Component\\Security\\Core\\Encoder\\PasswordEncoderInterface::encodePassword` + and + :method:`Symfony\\Component\\Security\\Core\\Encoder\\PasswordEncoderInterface::isPasswordValid` + must first of all make sure the password is not too long, i.e. the password length is no longer + than 4096 characters. This is for security reasons (see `CVE-2013-5750`_), and you can use the + :method:`Symfony\\Component\\Security\\Core\\Encoder\\BasePasswordEncoder::isPasswordTooLong`_ + method for this check: + + use Symfony\Component\Security\Core\Exception\BadCredentialsException; + + class FoobarEncoder extends BasePasswordEncoder + { + public function encodePassword($raw, $salt) + { + if ($this->isPasswordTooLong($raw)) { + throw new BadCredentialsException('Invalid password.'); + } + + // ... + } + + public function isPasswordValid($encoded, $raw, $salt) + { + if ($this->isPasswordTooLong($raw)) { + return false; + } + + // ... + } Using Password Encoders ~~~~~~~~~~~~~~~~~~~~~~~