Auth::attempt 值始终为假

Question

我想登录时遇到了一些问题，我的 Auth::attempt 总是错误的值有问题，我的代码有问题吗？

控制器：

public function register(Request $register)
{
    $validator = Validator::make($register->all(), [
        'name' => 'required',
        'email' => 'required|email',
        'password' => 'required',
    ]);
    if ($validator->fails()) {
        return response()->json(['error' => $validator->errors()], 401);
    } else {
        $name = $register->input('name');
        $email = $register->input('email');
        $pwd = $register->input('password');
        $c_pwd = $register->input('c_password');

        // Crypting password & c_password to md5
        $md5_pwd = md5($pwd);
        $md5_c_pwd = md5($c_pwd);

        // Salt password & c_password 
        $password = crypt($md5_pwd, "asd");
        $c_password = crypt($md5_c_pwd, "asd");

        $data = new User();

        if ($password == $c_password) {
            $user = User::create([
                'name' => $name,
                'email' => $email,
                'password' => $password,
            ]);
            $success['token'] = $user->createToken('SSOApp')->accessToken;
            return response()->json([
                'success' => true,
                'token' => $success,
                'user' => $user
            ]);
        } else {
            return response()->json(['error' => "Password doesn't match"], 401);
        }
    }
}

public function login()
{
    $email = request('email');
    $pwd = request('password');
    $md5 = md5($pwd);
    $password = crypt($md5, "asd");
    if (Auth::attempt(['email' => $email, 'password' => $password])) {
        $user = Auth::user();
        $success['token'] = $user->createToken('SSOApp')->accessToken;
        return response()->json([
            'success' => true,
            'token' => $success,
            'user' => $user
        ]);
    } else {
        return response()->json([
            'success' => false,
            'message' => 'Invalid Email or Password',
        ], 401);
    }
}

Answer 1

试试这个代码。我不知道关于您在 attempt.

中尝试加密密码的代码发生了什么

public function login(LoginRequest $request) {
      if(!Auth::attempt([
        'email' => $request->email,
        'password' => $request->password,
        'active' => true
      ])) {
        return response()->json('Email or Password is incorrect', 500);
      }

      $this->user = Auth::user()->load('roles');
      return $this->createUserAccessTokenResponse();
    }

protected function createUserAccessTokenResponse() {
      return response()->json([
        'status' => 'success',
        'data' => [
          'token' => $this->user->createToken($this->user->name)->accessToken,
          'user' => $this->user
        ],
      ], 200);
    }

Answer 2

您的问题是 laravel 默认情况下对密码进行哈希处理。因此，当您执行 Auth::attempt 时，它会散列您提供的密码。结果就是你得到的，它永远是假的。

相反，您需要 Other Authentication Methods。

Auth::login($user);

// Login and "remember" the given user...
Auth::login($user, true);

以上是修复代码的最简单方法。

建议对密码进行哈希处理而不是加密密码。

laravel 中的散列密码也是

Hash::make($password);

然后您可以使用Auth::attempt登录您的用户。

Answer 3

我假设你搞砸了 Laravel 默认密码哈希系统

public function register(Request $register)
{
    $validator = Validator::make($register->all(), [
        'name' => 'required',
        'email' => 'required|email',
        'password' => 'required',
        'c_password' => 'required|same:password',
    ]);
    if ($validator->fails()) {
        return response()->json(['error' => $validator->errors()], 401);
    } else {
        $name = $register->input('name');
        $email = $register->input('email');
        $pwd = $register->input('password');
        $c_pwd = $register->input('c_password');


        // $data = new User();

        $user = User::create([
                'name' => $name,
                'email' => $email,
                'password' => bcrypt($password . 'salt'),
        ]);

        $success['token'] = $user->createToken('SSOApp')->accessToken;
        return response()->json([
                'success' => true,
                'token' => $success,
                'user' => $user
        ]);

    }
}

public function login()
{
    $email = request('email');
    $pwd = request('password');

    if (Auth::attempt(['email' => $email, 'password' => $password . 'salt'])) {
        $user = Auth::user();
        $success['token'] = $user->createToken('SSOApp')->accessToken;
        return response()->json([
            'success' => true,
            'token' => $success,
            'user' => $user
        ]);
    } else {
        return response()->json([
            'success' => false,
            'message' => 'Invalid Email or Password',
        ], 401);
    }
}

Answer 4

而不是使用 md5 或 crypt 使用 \Hash::make() 它更安全
我重构了你的代码，它做了同样的事情
您只需要将 c_password 重命名为 password_confirmation
Source
下面的代码与您的代码执行相同的操作

public function register(Request $register)
{
    $this->validate($register, [
        'name' => 'required',
        'email' => 'required|email',
        'password' => 'required|confirmed',
    ]);

    $user = User::create([
        'name' => $register->input('name'),
        'email' => $register->input('email'),
        'password' => $register->input('password'),
    ]);
    $success['token'] = $user->createToken('SSOApp')->accessToken;

    return response()->json([
        'success' => true,
        'token' => $success,
        'user' => $user,
    ]);
}

public function login(Request $request)
{
    $request->merge(['password' => \Hash::make($request->input('password'))]);

    if (Auth::attempt($request->only(['email', 'password']))) {
        $user = Auth::user();
        $success['token'] = $user->createToken('SSOApp')->accessToken;

        return response()->json([
            'success' => true,
            'token' => $success,
            'user' => $user,
        ]);
    }

    return response()->json([
        'success' => false,
        'message' => 'Invalid Email or Password',
    ], 401);
}

当你使用 crypt 散列密码时，它有一个解锁它的密钥，这就是为什么有 decrypt 但当你使用 Hash::make() 它没有破解的密钥或者解锁它，它会检查它的算法，看看给定的密码是否与数据库中已经存在的算法相匹配，这就是为什么 crypt 不安全而 Hash::make 更安全

Answer 5

Laravel Auth 在通过模型保存密码时使用 bcrypt 哈希，您可以使用两种方法中的任何一种

$account->password = bcrypt("YOUR_PASSWORD"); 或 $account->password = Hash::make("YOUR_PASSWORD");

然后，如果您正在处理 auth attempt 函数，只需像这样调用方法即可

if($account = Auth::attemp(['email' => "YOUR_EMAIL@DOMAIN.COM",  'password' => "YOUR_PASSWORD"])){
    //success login, do your extra job here
}else{
    //invalid credentials here
}

Auth::attempt 值始终为假

Auth::attempt value always false

authentication

laravel

laravel-passport