Phalcon PHP Password Bcrypt - php

Question

So, I have setup in my di, the security component, as such...
--services.php--
$di->set('security', function(){
$security = new Phalcon\Security();
//Set the password hashing factor to 11 rounds
$security->setWorkFactor(11);
return $security;
}, true);
--Custom Auth Library (auth.php)--
$user = Users::findFirstByEmail($login);
if ($user) {
if ($this->security->checkHash($password, $user->password)) {
return true;
}
}
return false;
but, for some reason, this always returns false...so, to debug, I tried using PHP's password_verify function, the following code is in my view directly:
//Returns false
var_dump($this->security->checkHash('password', '$2a$12$aSa7zLEd24zjh2aoUasxd.hbxIm8IQ0/vMf/8p4LTYI3VtZMJ62Pe'));
//Returns True
var_dump(password_verify('password', '$2a$12$aSa7zLEd24zjh2aoUasxd.hbxIm8IQ0/vMf/8p4LTYI3VtZMJ62Pe'));
What am I missing???

Answer 1

Okay, so it seems that if I set both the hash, and the password to a variable, it parses both statements correctly.
I appreciate all of the help, but this was the final solution.
$password = $pass;
$hash = '$2a$12$lDL2eQ1GLJsJhKgPvU6agOnHpwNSBYPtWHF/O/aTvyISzI.ugjyLC';
var_dump($this->security->checkHash($password, $hash));
var_dump(password_verify($password, $hash));

Answer 2

This might be related to Security::checkHash returns true when using with a non-bcrypt hash, which has been fixed a few days ago.
Looking at the code, the problem might be within this block, can you verify that the user model gets loaded, so does his hashed password?
$user = Users::findFirstByEmail($login);
if ($user) {
if ($this->security->checkHash($password, $user->password)) {
return true;
}
}
return false;

Answer 3

In case someone gets here and none of the answers above seem to help, and you keep feeling more and more dumb, check the password column length in your users table!!. In my case it was a varchar(50) and the hash gives you 60 chars.
Doing this (pointed above) http://pastebin.com/6tNRgyXg, helped me realise that something other than the code was wrong.