Challenge 2 / 2

Why does hashPassword() take the $user object and not just the plain password?

Because hashPassword() saves the user to the database at the same time, and it needs the full object to do that.

Because Symfony mixes the user’s email/ID into the hash automatically (as a built-in “salt”), so it needs the $user to build the final hash.

Because Symfony picks the right hashing setup based on the user class (and its settings), so it needs the $user to know which hasher to use.

Because the plain password is stored inside the $user object, so hashPassword() has to read it from there.