Friday, March 10, 2017

Laravel - How to check value with another encrypted in DB

I am developing a sales system where every user has an account. To authenticate users I store passwords with bcrypt and use the Laravel Auth library as follows:

$data = $request->only('user', 'password');        
if (\Auth::attempt($data)){
    #redirect dashboard
}

In the Point Of Sale screen, user can add special products that require a PIN (The PIN is the password of some users with privileges).

When i call a button click to save the sale, in my Request class i add this validation (i only need to check if there are some special products, and if, check the PIN that have to match in the DB), i use this code:

    $allowed_pin = true;
    foreach (Request::get('products') as $product) {
        if($product["special_perm"] === "1"){
            $pin = $product["pin"];
            $user = User::where('password', '=', bcrypt($pin))->first();
            if ($user) {
                $allowed_pin = true;
            } else {
                $allowed_pin = false;
            }
        }
    }

The problem is when i compare password in Request class, if i use dd() it show me "$2y$10$AasS5/FTWv28PmYuABfqve4Ao6m1U9zxdUE6ZoHJWcfpn19sd4wcG" and real password hashed in database is "$2y$10$DmefHppecIjuanjRbcj82OPyjhi.L0/4YGd62LYCvkDTGjXxL25fG" and they not matching. Does Auth class use some internal encryption different to bcrypt?



via Agustin Nicolas Busso

Advertisement