Weave Code
Advanced Encoder Bundle Laravel Package
friendsofsymfony/advanced-encoder-bundle
A Symfony bundle that provides an advanced password encoder factory, letting different users use different encoders. Useful for migrating legacy password hashes and gradually upgrading users to stronger algorithms without forcing password resets or locking accounts out.
This bundles adds the ability to define the encoder on an instance basis in your Symfony2 project
Frequently asked questions about Advanced Encoder Bundle
- Can I use FOSAdvancedEncoderBundle in a Laravel application?
- No. It is a Symfony2 bundle that decorates security.encoder_factory and relies on Symfony 2.3-era security internals. Laravel has no bundle system or EncoderFactory extension point, so composer require will fail or pull incompatible Symfony security packages. Use Laravel's HashManager and Hasher contracts instead.
- How do I install friendsofsymfony/advanced-encoder-bundle?
- It is installed with Composer as friendsofsymfony/advanced-encoder-bundle, but only in a Symfony 2.x application. In Laravel you should not install it because dependency resolution may fail or bring stale Symfony components into the project. For Laravel, configure hashing drivers in config/hashing.php instead.
- Does FOSAdvancedEncoderBundle support Laravel 10 or 11?
- No Laravel version is supported. The package targets Symfony 2.3+ and PHP 5.x, including PHP 5.5 and 5.6, with HHVM in its test matrix, and it is archived and unmaintained. Every supported Laravel release requires PHP 8.1+, so there is no compatible path. Do not rely on it for Laravel 10 or 11.
- What is FOSAdvancedEncoderBundle used for?
- It extends Symfony's encoder system so different user records can use different password encoders, which is useful for migrating legacy hashes or gradually upgrading algorithms. It registers a compiler pass and decorates the encoder factory to select an encoder per user instance. In Laravel this maps conceptually to a resolver that returns a Hasher per user, not to the package itself.
- How do I choose a password hasher per user in Laravel?
- Use Laravel's HashManager drivers in config/hashing.php and a small first-party resolver that returns the right Hasher for an Authenticatable before check(). Store the algorithm identifier server-side per user and never accept it from user input. After successful verification, call needsRehash() and rehash with the current driver.
- Is FOSAdvancedEncoderBundle safe for production password hashing?
- No, not for Laravel production. It is archived, unmaintained, has no security patches or CVE monitoring, and targets removed Symfony interfaces and PHP 5.x. Password hashing is a security-critical path, so unmaintained code is a risk no migration convenience offsets. Implement the per-user encoder pattern in first-party Laravel code with supported drivers.
- Can it help migrate legacy password hashes in Laravel?
- It can inspire a migration pattern but cannot be dropped into Laravel. A native approach stores a trusted algorithm marker per user, verifies with the matching Laravel hasher or a custom verifier, then rehashes to bcrypt or argon2 on success. For weak legacy formats, force a reset instead of verifying.
- What are alternatives to FOSAdvancedEncoderBundle for Laravel?
- Use Laravel's built-in bcrypt and argon2id drivers, hash_pbkdf2() for compatible PBKDF2, and community hashing drivers where needed. Wrap them in a small per-user resolver plus a rehash-on-success hook. Avoid adding an unmaintained Symfony2 bundle to a Laravel authentication path.
- Does FOSAdvancedEncoderBundle support PHP 8 and modern Symfony?
- No. The release notes mention Symfony 2.3+ and test PHP 5.5 and 5.6, and HHVM was added to the matrix, which has been EOL since 2018. There is no PHP 7 or PHP 8 path and no movement toward modern Symfony. Laravel's supported PHP 8.1+ requirement makes it unusable.
- How should I test per-user password encoder migration?
- Test each stored hash format with known-good vectors, including PBKDF2 iteration count, digest, key length, and salt encoding if applicable. Verify the resolver picks only trusted server-side algorithm values and that unknown or downgrade attempts fail closed. Assert rehash-on-success upgrades to the current Laravel driver and that weak formats force reset.
Weaver
How can I help you explore Laravel packages today?