Password Hasher Laravel Package

Technical Evaluation

Architecture Fit

• Seamless Laravel Integration: Designed for Laravel’s ecosystem, replacing or extending the Hash facade and Illuminate\Auth\Passwords\PasswordBroker with zero breaking changes to existing authentication flows. Leverages Laravel’s service container for dependency injection, ensuring compatibility with Fortify, Sanctum, Passport, and custom auth systems.
• Algorithm-Agnostic Design: The PasswordHasherFactory abstracts hashing logic, allowing dynamic algorithm selection (e.g., bcrypt for standard users, Argon2id for admins) via configuration. This aligns with Laravel’s modularity and Symfony’s component-based architecture, enabling gradual security upgrades.
• Compliance-Ready: Directly supports GDPR (Article 32), PCI DSS 3.2.1, and NIST SP 800-63B by replacing deprecated hashing methods. The package’s auto-rehashing feature (on login) mitigates legacy hash vulnerabilities without manual intervention.
• Extensibility: Supports custom hashers via the PasswordHasherInterface, allowing integration with third-party algorithms (e.g., scrypt) or internal security policies (e.g., per-tenant hashing rules).

Integration Feasibility

• Low-Coupling: Replaces only the hashing layer, leaving authentication workflows (e.g., login, registration) untouched. Laravel’s Hash facade can be swapped atomically with minimal code changes.
• Backward Compatibility: Existing bcrypt hashes (generated via Laravel’s Hash::make()) remain valid, reducing migration risk. Legacy hashes (e.g., SHA-1) can be gradually rehashed on login.
• Configuration-Driven: Algorithm selection is centralized in the PasswordHasherFactory, enabling environment-specific hashing (e.g., Argon2id in staging, bcrypt in production).
• Tooling Synergy: Works with Laravel’s Artisan commands (e.g., make:auth), Tinker, and debugbar for seamless development and troubleshooting.

Technical Risk

• Algorithm Performance: Argon2id/Sodium may introduce latency spikes (e.g., 100–300ms per hash) if not benchmarked. Mitigation: Start with bcrypt, monitor performance, and gradually introduce memory-hard algorithms for high-risk roles.
• PHP Version Dependency: Requires PHP 8.1+ (Symfony 6.4+) or PHP 8.4+ (Symfony 8.0). Risk for legacy Laravel apps (e.g., LTS 8.x). Mitigation: Use Symfony 6.x for broader compatibility.
• Key Rotation Complexity: Migrating from legacy hashes (e.g., SHA-1) to modern algorithms requires strategic sequencing (see Integration Approach). Risk of user lockouts if not tested in staging.
• Custom Salting Needs: Symfony’s default salting may conflict with existing salting schemes (e.g., per-user salts). Mitigation: Validate against Laravel’s Hash service or extend the PasswordHasherFactory.

Key Questions

1. Algorithm Selection:

   • Should we default to bcrypt (low risk) or Argon2id (high security) for standard users? What’s the performance impact of Argon2id on our infrastructure?
   • Do we need per-role algorithms (e.g., Argon2id for admins, bcrypt for guests)?

2. Migration Strategy:

   • How will we detect and rehash legacy hashes (e.g., SHA-1, plaintext) without disrupting active sessions?
   • Should we force rehashing on login or implement a background job for gradual migration?

3. Compatibility:

   • Are there third-party packages (e.g., Laravel Passport, Socialite) that rely on Laravel’s Hash facade? How will we test integration?
   • Does our CI/CD pipeline support PHP 8.1+? If not, what’s the upgrade path?

4. Monitoring and Alerts:

   • How will we track failed password verifications (e.g., legacy hash mismatches) post-migration?
   • Should we log algorithm usage for compliance audits?

5. Future-Proofing:

   • How will we handle algorithm deprecation (e.g., bcrypt in 5 years)? Should we implement a rotation policy?
   • Does the package support post-quantum algorithms (e.g., Argon2id’s quantum resistance)? If not, what’s the upgrade path?

Integration Approach

Stack Fit

• Laravel Native: The package is Symfony’s foundation for password hashing, ensuring 100% compatibility with Laravel’s Hash facade, Illuminate\Auth, and Laravel Breeze/Fortify. No need for polyfills or shims.
• Symfony Ecosystem: If using Lumen or Symfony components, the integration is identical to Laravel, with additional support for Symfony’s security:hash-password command.
• Third-Party Synergy: Works with:
  • Laravel Passport: No changes needed—uses Hash facade internally.
  • Laravel Sanctum: Compatible; API token hashing remains unaffected.
  • Laravel Socialite: Supports OAuth provider password hashing (e.g., GitHub, Google).
  • Spatie Laravel-Permission: Integrates with role/user password policies.

Migration Path

Phase 1: Assessment (1–2 weeks)

• Audit: Scan codebase for hardcoded hashing (e.g., password_hash(), Hash::make()).
• Benchmark: Test bcrypt vs. Argon2id performance under load (e.g., 10K RPS).
• Stakeholder Alignment: Confirm algorithm choices (e.g., bcrypt for MVP, Argon2id for compliance).

Phase 2: Configuration (1 day)

1. Install Package:

   composer require symfony/password-hasher
   

2. Update Laravel’s Hash Service (config/app.php):

   'hash' => [
       'driver' => Symfony\Component\PasswordHasher\Hasher\PasswordHasherFactory::class,
       'config' => [
           'default' => ['algorithm' => 'bcrypt'],
           'admin'   => ['algorithm' => 'argon2id'],
       ],
   ],
   

3. Extend AuthServiceProvider (if using custom hashing):

   public function boot()
   {
       $this->app['hash'] = $this->app->extend('hash', function ($hash, $app) {
           return new PasswordHasherFactory($app['config']['hash.config']);
       });
   }
   

Phase 3: Legacy Hash Migration (2–4 weeks)

• Option A: Force Rehash on Login (Low Risk): Extend Illuminate\Auth\Events\Attempting to rehash legacy hashes:

  event(new Attempting($credentials));
  // In listener:
  if (str_starts_with($user->password, '$2y$')) { // bcrypt
      return;
  }
  $user->password = $factory->getPasswordHasher('default')->hash($credentials['password']);
  $user->save();
  

• Option B: Background Job (High Throughput): Use Laravel Queues to rehash hashes asynchronously:

  // Command: php artisan rehash:legacy
  RehashLegacyHashes::dispatch();
  

  class RehashLegacyHashes implements ShouldQueue
  {
      public function handle()
      {
          User::where('password', 'like', '%$2a$%') // SHA-1/MD5
              ->chunk(100, function ($users) {
                  $factory = app(PasswordHasherFactory::class);
                  foreach ($users as $user) {
                      $user->password = $factory->getPasswordHasher('default')->hash($user->password);
                  }
                  User::upsert($users->toArray());
              });
      }
  }
  

Phase 4: Validation (1 week)

• Unit Tests: Verify PasswordHasherFactory integration with:
  • Hash::make() and Hash::check().
  • Custom algorithms (e.g., Argon2id).
• Penetration Testing: Confirm no weak hashes remain (e.g., SHA-1).
• Load Testing: Simulate 10K concurrent logins to validate performance.

Compatibility