Migrate Password Hashing

I'm also curious about this. https://symfony.com/blog/ne... shows using "algorithm: auto". Which one should I use?

Hey Kevin B. and @Kevin Bond!

Great question - I should have mentioned that! Algorithm auto is perfect to use. I was focusing more on the case of "how do I upgrade my old algorithm (auto is not an old algorithm) to a new one" and the migrate_from is perfect for that.

To be clear, a few points:
A) auto should be used for new projects... as it manages everything for you. As a bonus, it comes migrate_from "built-in" - but only for a few, specific encoders/algorithms. You can specify another algorithm it should include in its built-in migrate_from via the hash_algorithm option... but basically I find that "auto" is confusing if you're trying to use it to migrate from an old encoder. But it's perfect for new projects.

B) auto and the migrate_from option are incompatible with each other: you can only use one of them, not both together. If you're migrating passwords from an old algorithm/encoder, the migrate_from is much clearer to use.

Btw, credit to Nicolas Grekas who was answering my original questions about all of this for the tutorial :).

Cheers!

I hate symfony for this "auto and the migrate_from option are incompatible with each other:" I have spent so many hours for simple password hash migration. It should give error. I just does nothing and I have no idea why it is not working. I am just lukcy that I found this comment. I have wasted so many hours for such a simple thing which become not simple when it does not give errors :(

Thanks Ryan,

My app currently uses bcrypt for all users. I want to migrate them to the latest but also never have to worry about upgrading them to the latest again. This is why auto was so appealing to me.

I looked into this a bit further and did some testing. Turns out simply switching my algo from "bcrypt" to "auto" works out of the box. Existing users with bcrypt passwords can still login. Once I implemented the appropriate migration interfaces passwords are properly migrated to "argon2id" on login. I assume, in the future, if a better algo is available, they will be seamlessly migrated to it.

Yo Kevin B.!

You got it - bcrypt works with argon, which is what auto is using right now anyways.

I assume, in the future, if a better algo is available, they will be seamlessly migrated to it.

That's my impression as well :). Though, I believe (this is from talking with Nicolas) that even if you chose Sodium, if you needed to change to something else in the future, that change should be seamless as well. They key thing is that modern encoders embed the algorithm details into the hash, which means that future hashers can handle them. That's precisely why sodium (which uses argon) is able to handle your bcrypt passwords without any issue.

A tl;dr on this might be:
A) Try switching to auto! Can you still log in using your older users! Coolio! Use that - the "migrate_from" is built-in.
B) If not, use migrate_from so that you can explicitly tell Symfony how to handle your old users.

Cheers!

was not able to migrate with auto. But at least with setting migrate_from and exact new algo it works.