Laravel Auth: These credentials do not match our records - php

Question

I am really new to Laravel. And I am enjoying every bit of the framework. I have recently run into some problems with Authentication/Login.
User registration works fine, but when I try to login using the same credentials created during registration, the app throws up this error:
These credentials do not match our records
I have also looked in the users table within the database and all the fields from the registration form is captured. I am just wondering why the app fails to retrieve these from the database.
See below my LoginController code:
namespace App\Http\Controllers\Auth;
use App\Models\User;
use Illuminate\Http\Request;
use App\Http\Controllers\Controller;
use Illuminate\Foundation\Auth\AuthenticatesUsers;
use Firebase\JWT\JWT;
class LoginController extends Controller
{
/*
|--------------------------------------------------------------------------
| Login Controller
|--------------------------------------------------------------------------
|
| This controller handles authenticating users for the application and
| redirecting them to your home screen. The controller uses a trait
| to conveniently provide its functionality to your applications.
|
*/
use AuthenticatesUsers;
/**
* Where to redirect users after login.
*
* #var string
*/
protected $redirectTo = '/dashboard';
// Get your service account's email address and private key from the JSON
key file
protected $service_account_email = "abc-123#a-b-c-
123.iam.gserviceaccount.com";
protected $private_key = "-----BEGIN PRIVATE KEY-----...";
/**
* Create a new controller instance.
*
* #return void
*/
public function __construct()
{
$this->middleware('guest')->except('logout');
$this->service_account_email = config('services.firebase.client_email');
$this->private_key = config('services.firebase.private_key');
}
/**
* Get the needed authorization credentials from the request.
*
* #param \Illuminate\Http\Request $request
* #return array
*/
protected function credentials(Request $request)
{
$data = $request->only($this->username(), 'password');
$data['email_confirmed'] = 1;
return $data;
}
protected function authenticated(Request $request, $user)
{
$jwt = $this->create_custom_token($user,false);
session(['jwt' => $jwt]);
return redirect()->intended($this->redirectPath());
}
function create_custom_token(User $user, $is_premium_account) {
$now_seconds = time();
$payload = array(
"iss" => $this->service_account_email,
"sub" => $this->service_account_email,
"aud" => "https://identitytoolkit.googleapis.com/google.identity.identitytoolkit.v1.IdentityToolkit",
"iat" => $now_seconds,
"exp" => $now_seconds+(60*60), // Maximum expiration time is one hour
"uid" => $user->ref_code,
"email" => $user->email,
"name" => $user->name,
"phone_number" => $user->phone_number,
"claims" => array(
"premium_account" => $is_premium_account
)
);
return JWT::encode($payload, $this->private_key, "RS256");
}
}
How can I get this solved?

Answer 1

I found a solution to my problem above!
Okay, apparently, the issue was with the app double hashing the passwords. I read from http://laravel.com/docs/5.1/authentication
From where it talks about the attempt method:
"If the user is found, the hashed password stored in the database will be compared with the hashed password value passed to the method via the array. If the two hashed passwords match an authenticated session will be started for the user."
So even if I pass the correct password in with the form the attempt method is calling bcrypt on my password sent in from the form. Once it is hashed it is not going to match the plan text password anymore.
So, instead of trying to remember to hash my passwords on save/update/db seeding, I just added an attribute mutator to the User class:
public function setPasswordAttribute($password)
{
$this->attributes['password'] = bcrypt($password);
}
And voila! Issue solved

Answer 2

If you use this method to set password hashed
public function setPasswordAttribute($password)
{
$this->attributes['password'] = bcrypt($password);
}
Don't use hash or bcrypt method in controller or seeder to avoid hashed password twice, like this:
$admin = User::create([
'name' => 'Admin',
'username' => 'admin',
'email' => 'admin#admin.com',
'mobile' => '0123456789',
'role_id' => 1,
'status' => 1,
'email_verified_at' => Carbon::now(),
'bio' => 'Administrator',
'password' => 'admin',
]);

Answer 3

I also face this problem.
Lavarel by default hash your password, just change 'hash' to 'bcrypt' in RegisterController.php
protected function create(array $data)
{
return User::create([
'password' =>bcrypt($data['password']),
]);
}