How to validate bcrypt password in Laravel? - php

Question

I have a change password form with fields for old and new password
The old password field is named old_password.
In my controller i am validating the passwords like this
$this->validate($request, [
'old_password' => 'required|min:6|exists:users,password',
'password' => 'required|min:6:max:30',
]);
But its not working as im comparing the old_password directly with password without function bcrypt().
So how can i compare the old_password field with the already stored bcrypted password in user field.
Note: i want to give the validation error back that password does not
match if it is different

Answer 1

This is how I would make such a function
The HTML form
<form action="{{ url('admin/admin-admin-password-update/'.$admin->id) }}" method="post">
{{ csrf_field() }}
<div class="form-group {{ $errors->has('new_password') ? 'has-error' : '' }}">
<label for="new_password" class="form-label">New Password (Minimum of 6 characters. No spaces.) <span class="required-alert">*</span></label>
<input type="password" class="form-control" name="new_password" id="new_password" />
#if ($errors->has('new_password'))
<div class="help-block">
{{ $errors->first('new_password') }}
</div>
#endif
</div>
<div class="form-group {{ $errors->has('confirm_password') ? 'has-error' : '' }}">
<label for="confirm_password" class="form-label">Confirm New Password <span class="required-alert">*</span></label>
<input type="password" class="form-control" name="confirm_password" id="confirm_password" />
#if ($errors->has('confirm_password'))
<div class="help-block">
{{ $errors->first('confirm_password') }}
</div>
#endif
</div>
<div class="form-group clearfix">
<button type="submit" class="btn btn-primary">Save New Password</button>
</div>
</form>
controller code
public function updatePassword(Request $request)
{
$this->admin = Auth::user();
$this->id = $this->admin->id;
$this->validate($request, [
'current_password' => 'required',
'password' => 'required|min:6',
'confirm_password' => 'required|same:password',
]);
if (Hash::check($request->input('current_password'), $this->admin->password)) {
$this->admin->password = Hash::make($request->input('password'));
$this->admin->save();
return redirect()->back()->with('success', 'Your password has been updated.');
} else {
return redirect()->back()->with('warning', 'The current password you provided could not be verified');
}
}

Answer 2

You need to compare the hash results of both old_password and the other password you wish to compare.
// when old_password is not encrypted but other_password is:
bcrypt('old_password') === hash_of_other_password
One way of doing so with $this->validate and not writing custom rules would be to use $request->merge(). That way you can use the confirmed rule or even exists if you have the hashed value stored in your database.