Laravel Auth：这些凭据与我们的记录不匹配

Question

我对 Laravel 真的很陌生。我很享受这个框架的每一点。我最近遇到了一些身份验证/登录问题。

用户注册工作正常，但是当我尝试使用注册期间创建的相同凭据登录时，应用程序会抛出此错误：

这些凭据与我们的记录不符

我还查看了数据库中的用户表，并捕获了注册表单中的所有字段。我只是想知道为什么应用程序无法从数据库中检索这些。

请看下面我的 LoginController 代码：

namespace App\Http\Controllers\Auth;

use App\Models\User;
use Illuminate\Http\Request;
use App\Http\Controllers\Controller;
use Illuminate\Foundation\Auth\AuthenticatesUsers;
use Firebase\JWT\JWT;

class LoginController extends Controller
{
/*
|--------------------------------------------------------------------------
| Login Controller
|--------------------------------------------------------------------------
|
| This controller handles authenticating users for the application and
| redirecting them to your home screen. The controller uses a trait
| to conveniently provide its functionality to your applications.
|
*/

use AuthenticatesUsers;

/**
 * Where to redirect users after login.
 *
 * @var string
 */
protected $redirectTo = '/dashboard';

// Get your service account's email address and private key from the JSON 
key file
protected $service_account_email = "abc-123@a-b-c-
123.iam.gserviceaccount.com";

protected $private_key = "-----BEGIN PRIVATE KEY-----...";

/**
 * Create a new controller instance.
 *
 * @return void
 */
public function __construct()
{
    $this->middleware('guest')->except('logout');

    $this->service_account_email = config('services.firebase.client_email');
    $this->private_key = config('services.firebase.private_key');
}

    /**
 * Get the needed authorization credentials from the request.
 *
 * @param  \Illuminate\Http\Request  $request
 * @return array
 */
protected function credentials(Request $request)
{
    $data = $request->only($this->username(), 'password');
    $data['email_confirmed'] = 1;
    return $data;
}

protected function authenticated(Request $request, $user)
{

    $jwt = $this->create_custom_token($user,false);

    session(['jwt' => $jwt]);

    return redirect()->intended($this->redirectPath());
}

function create_custom_token(User $user, $is_premium_account) {

    $now_seconds = time();
    $payload = array(
        "iss" => $this->service_account_email,
        "sub" => $this->service_account_email,
        "aud" => "https://identitytoolkit.googleapis.com/google.identity.identitytoolkit.v1.IdentityToolkit",
        "iat" => $now_seconds,
        "exp" => $now_seconds+(60*60),  // Maximum expiration time is one hour
        "uid" => $user->ref_code,
        "email" => $user->email,
        "name" => $user->name,
        "phone_number" => $user->phone_number,
        "claims" => array(
            "premium_account" => $is_premium_account
        )
    );
    return JWT::encode($payload, $this->private_key, "RS256");
    }

    }

我怎样才能解决这个问题？

Answer 1

我找到了解决上述问题的方法！

好的，显然，问题在于应用程序对密码进行双重哈希处理。我从http://laravel.com/docs/5.1/authentication读到

从它谈到尝试方法的地方： “如果找到用户，存储在数据库中的哈希密码将与通过数组传递给方法的哈希密码值进行比较。如果两个哈希密码匹配，将为用户启动经过身份验证的会话。”

因此，即使我在表单中传递了正确的密码，尝试方法也会对从表单发送的密码调用 bcrypt。一旦它被散列，它将不再匹配计划文本密码。

因此，我没有尝试记住在保存/更新/数据库播种时对我的密码进行哈希处理，而是在 User 类中添加了一个属性修改器：

public function setPasswordAttribute($password)
{
$this->attributes['password'] = bcrypt($password);
}

瞧！问题解决了

Answer 2

如果你使用这种方法设置密码散列

public function setPasswordAttribute($password)
{
    $this->attributes['password'] = bcrypt($password);
}

不要在控制器或播种器中使用 hash 或 bcrypt 方法以避免两次哈希密码，如下所示：

$admin = User::create([
            'name' => 'Admin',
            'username' => 'admin',
            'email' => 'admin@admin.com',
            'mobile' => '0123456789',
            'role_id' => 1,
            'status' => 1,
            'email_verified_at' => Carbon::now(),
            'bio' => 'Administrator',
            'password' => 'admin',
        ]);

Answer 3

我也面临这个问题。

Lavarel 默认对您的密码进行哈希处理，只需在 RegisterController.php

中将 'hash' 更改为 'bcrypt'

protected function create(array $data)
    {
        return User::create([
            'password' =>bcrypt($data['password']),
        ]);
    }