[Security] Can't use custom password hasher

[holloway87]

Symfony version(s) affected: 5.3.1

Description
I want to use a custom password hasher for my project. I can't find any documentation on how to configure it in the security.yaml. I implemented the interface UserPasswordHasherInterface and configured it as described in here: https://symfony.com/doc/current/security/named_hashers.html
When i try a unit test to login my user, i get this error message:
TypeError: Symfony\Component\PasswordHasher\Hasher\PasswordHasherFactory::createHasher(): Argument #1 ($config) must be of type array, App\Security\Hasher\AmUserPasswordHasher given, called in [...]/vendor/symfony/password-hasher/Hasher/PasswordHasherFactory.php on line 67

Here's the stack trace:

[...]/vendor/symfony/password-hasher/Hasher/PasswordHasherFactory.php:79
[...]/vendor/symfony/password-hasher/Hasher/PasswordHasherFactory.php:67
[...]/vendor/symfony/security-core/Authentication/Provider/DaoAuthenticationProvider.php:100
[...]/vendor/symfony/security-core/Authentication/Provider/UserAuthenticationProvider.php:86
[...]/vendor/symfony/security-core/Authentication/AuthenticationProviderManager.php:88
[...]/vendor/symfony/security-http/Firewall/UsernamePasswordJsonAuthenticationListener.php:136
[...]/vendor/symfony/security-bundle/Debug/WrappedLazyListener.php:49
[...]/vendor/symfony/security-http/Firewall/AbstractListener.php:26
[...]/vendor/symfony/security-bundle/Debug/TraceableFirewallListener.php:62
[...]/vendor/symfony/security-http/Firewall.php:86
[...]/vendor/symfony/event-dispatcher/Debug/WrappedListener.php:117
[...]/vendor/symfony/event-dispatcher/EventDispatcher.php:230
[...]/vendor/symfony/event-dispatcher/EventDispatcher.php:59
[...]/vendor/symfony/event-dispatcher/Debug/TraceableEventDispatcher.php:151
[...]/vendor/symfony/http-kernel/HttpKernel.php:133
[...]/vendor/symfony/http-kernel/HttpKernel.php:79
[...]/vendor/symfony/http-kernel/Kernel.php:199
[...]/vendor/symfony/http-kernel/HttpKernelBrowser.php:63
[...]/vendor/symfony/framework-bundle/KernelBrowser.php:159
[...]/vendor/symfony/browser-kit/AbstractBrowser.php:402
[...]/tests/Controller/UserAuthControllerLoginTest.php:53

How to reproduce
I created the custom password hasher class in the App\Security\Hasher namespace and it implements the interface Symfony\Component\PasswordHasher\Hasher\UserPasswordHasherInterface.
This is my security.yaml:

security:
    password_hashers:
        app_hasher:
            id: 'App\Security\Hasher\AmUserPasswordHasher'

In addition, when i tried to find out about the password hasher component, in the project it links the documentation to this, but it returns a 404: https://symfony.com/doc/current/password-hasher.html

[stof]

A custom hasher must implement PasswordHasherInterface, not UserPasswordHasherInterface (UserPasswordHasherInterface is the higher-level API for consuming the component with less boilerplate)

[holloway87]

Thank you, when i switch to the PasswordHasherInterface interface it works. The documentation is misleading then, since it says i have to use the UserPasswordHasherInterface (At the bottom of the page): https://symfony.com/doc/current/security/named_hashers.html
If you do that you get the error i mentioned above.

[derrabus]

The documentation is misleading then, since it says i have to use the UserPasswordHasherInterface

Indeed! Do you mind creating an issue (or better: a PR) over at https://github.com/symfony/symfony-docs/ ?

Closing because this is not a bug.

[xosofox]

I'm working on a legacy project that incorporates the username in the password hash, so I'd really like to use a UserPasswordHasher where the user is also available to ->hash() (or hashPassword() respectively) instead of a PasswordHasher.

Is there a way to achieve this?

Is there any chance to redirect the HasherFactory? Or any other approach I am not seeing?

[chalasr]

@xosofox Please consider using our support platforms: https://symfony.com/support.