Check whether password is correct or not in Laravel

Question

In laravel I want to check if user enter current password than check with that password which is store in database in that user data. If correct than continue otherwise give message Password is incorrect.

I am new in laravel so not getting exact idea for this.

Thanks in advance.

$('#pwd').blur(function(){
            var oldpwd=$('#pwd').val();
            var uid = $('#id').val();
            console.log(uid);
            if(oldpwd != "")
            {
              $.ajax({
                  url : "{{ url/profile/checkOldPwd}}",
                  data : { oldpwd:oldpwd , uid:uid },
                  type : "POST",
                  success : function(data) {
                    if(data == 0){
                      $("#msg-old").show();
                      $("#msg-old").html("Password is Incorrect!");
                      $("#pwd").val("");
                      $("#pwd").focus();
                  }
                  else
                  {
                    $("#msg-old").hide();
                    $("#msg-old").html("");
                  }
                }
                });
              }
            });

I just try using ajax but not getting how to check with so can you give some idea? — Kim Jones
– Kim Jones, Commented Jul 22, 2016 at 5:33
Check documentation link for more info regarding authorization or show us your code to help you. — Nitish Kumar
– Nitish Kumar, Commented Jul 22, 2016 at 5:47

Leon Vismer · Accepted Answer · 2016-07-22 06:31:56Z

96

As Hiren has mentioned you can use the default registered hasher as that is passed to the specific UserProvider used. The default is Illuminate\Hashing\BcryptHasher.

You can use it a couple of ways:

Out of the container

$user = User::find($id);
$hasher = app('hash');
if ($hasher->check('passwordToCheck', $user->password)) {
    // Success
}

Using the Facade

$user = User::find($id);
if (Hash::check('passwordToCheck', $user->password)) {
    // Success
}

Out of interest using the generic php function password_verify also works. However that works because the default hashing algorithm it uses is bcrypt.

if (password_verify('passwordToCheck', $user->password)) {
    // Success
}

answered Jul 22, 2016 at 6:31

Leon Vismer

5,1151 gold badge22 silver badges23 bronze badges

Sign up to request clarification or add additional context in comments.

5 Comments

Jonathan Over a year ago

Which do you prefer? Is out of the container the most elegant/fastest?

Leon Vismer Over a year ago

Personally I more and more prefer the out of the container (1)

Kiran Maniya Over a year ago

@LeonVismer What if the existing password hash stored in the database needs to be rehashed?

Leon Vismer Over a year ago

@KiranManiya If the work factor was adjusted one can use Hash:needsRehash($hashed) to check for that.

Kiran Maniya Over a year ago

@LeonVismer Yup, I got it. I updated the answer as well.

Hiren Makwana · Accepted Answer · 2016-07-22 06:10:42Z

7

you can use hash:check method.

create password using hash:

$password = Hash::make('secret');

check password:

if (Hash::check('secret', $hashedPassword))
{
    // The passwords match...
}

answered Jul 22, 2016 at 6:10

Hiren Makwana

2,1462 gold badges16 silver badges30 bronze badges

Comments

Dastur · Accepted Answer · 2017-08-16 17:59:03Z

6

When the user attempts to access the page, redirect them to an auth page.

Do the ajax call then do the following in your php:

public function check(Request $request)
{
    if(Hash::check($request->password, $user->password)) {
        // They match
    } else {
        // They don't match
    }
}

I havn't tested this so it might not work.

edited Aug 16, 2017 at 17:59

answered Jul 22, 2016 at 6:08

Dastur

7146 silver badges23 bronze badges

2 Comments

shukshin.ivan Over a year ago

This won't work. Bcrypt returns different string every time, it is not like md5

Developer Over a year ago

@Dastur thank youuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuu💕💕💕💕💕💕💕💕💕💕💕💕💕💕💕💕💕

Philipp Mochine · Accepted Answer · 2021-07-22 12:55:42Z

5

Wow it's actually super simple:

$request->validate([
     'password' => 'required|string|password',
]);

The field under validation must match the authenticated user's password.

However for people in the future:

This rule was renamed to current_password with the intention of removing it in Laravel 9. Please use the Current Password rule instead.

So it's

$request->validate([
     'password' => 'required|string|current_password',
]);

Source

answered Jul 22, 2021 at 12:55

Philipp Mochine

4,76512 gold badges47 silver badges81 bronze badges

Comments

Asfar Hussain Siddiqui · Accepted Answer · 2022-08-30 10:05:26Z

3

Password is correct or not , authenticate password in laravel PHP: Just do it

public function authenticateEmployee(array $data){

 $email = $data['email'];
 $password = $data['password'];
 $user = User::where('email', '=', $email)->first();   //get db User data   

 if(Hash::check($password, $user->password)) {   
      return response()->json(['status'=>'false','message'=>'password is correct']);
    } else {
        return 'false';
    }
}

Hit upvote :) Please

edited Aug 30, 2022 at 10:05

answered Feb 27, 2019 at 15:12

Asfar Hussain Siddiqui

5625 silver badges12 bronze badges

1 Comment

johannchopin Over a year ago

Maybe it's a better practice to get the email like this $data->get('email') instead of $data['email']?

eylay · Accepted Answer · 2023-07-25 06:01:58Z

2

None of the answers have mentioned that where is Hash class located! We first need to use Hash

use Illuminate\Support\Facades\Hash;

Now we can use check method

Hash::check($request->password, $user->password)

answered Jul 25, 2023 at 6:01

eylay

2,2604 gold badges34 silver badges63 bronze badges

Comments

Jeferson Lemos · Accepted Answer · 2020-10-27 04:57:53Z

1

if (Hash::check($request->password, Auth::user()->password)) { //Sucess }

answered Oct 27, 2020 at 4:57

Jeferson Lemos

111 bronze badge

Comments

Luis Gomes · Accepted Answer · 2021-08-09 01:41:11Z

The authentication logic in laravel 6.* is in "vendor\laravel\framework\src\Illuminate\Foundation\Auth\AuthenticatesUsers.php". In this file, you'll find sendFailedLoginResponse() method, which we are going to override on LoginController.php

protected function sendFailedLoginResponse(Request $request)
    {

        if (!User::where('email', $request->email)->first()) {
            throw ValidationException::withMessages([trans('auth.email')]);
        }
        
        if (!User::where('email', $request->email)->where('password', bcrypt($request->password))->first()) {
            throw ValidationException::withMessages([trans('auth.password')]);
        }
    }

This custom method verifies if a user is present on the database, looking for the unique value that you set up on your model. If the user is present on the database, the password is checked. Then, you can call the errors with

@if($errors->any())
<div class="alert alert-danger" >
  <ul>
    @foreach($errors->all() as $error)
      <li>{{ $error }}</li>
    @endforeach
  </ul>

</div>

@endif

on your blade file. Remember that you call those auth.* files from "resources\lang\en\auth.php"

Davor Minchorov · Accepted Answer · 2016-07-22 06:09:20Z

0

Hit the server route with your AJAX call.
Check the result of auth()->attempt($request->only('email', 'password'))
Return JSON back with a message and HTTP status code (200 if it is successful, 400 if it failed).
Show the message in the success() method to a div. If it is an error, show the error message inside the error() method to a div.

answered Jul 22, 2016 at 6:09

Davor Minchorov

2,0761 gold badge16 silver badges20 bronze badges

Collectives™ on Stack Overflow

Check whether password is correct or not in Laravel

9 Answers 9

5 Comments

Comments

2 Comments

Comments

1 Comment

Comments

Comments

Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

9 Answers 9

5 Comments

Comments

2 Comments

Comments

1 Comment

Comments

Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related