Symfony 3 : password validation - symfony

Question

I use this code to validate user password :
$encoderService = $this->container->get('security.password_encoder');
$match = $encoderService->isPasswordValid($user, $request->query->get('password'));
but it always returns 'false' even the password is correct

Answer 1

You're using the password encoder in the wrong way... Check Symfony doc on security
Here is an example on how to use it.
app/config/security.yml
security:
encoders:
AppBundle\Entity\Security:
algorithm: bcrypt
src/AppBundle/Controller/SecurityController.php
class SecurityController extends Controller {
private $tokenManager;
private $encoder;
public function __construct(CsrfTokenManagerInterface $tokenManager=null, UserPasswordEncoderInterface $encoder) {
$this->tokenManager=$tokenManager;
$this->encoder=$encoder;
}
**[...]**
public function editAction(Security $user) {
if($user->getOldPassword() !== null && $user->getPlainPassword() !== null && $this->encoder->isPasswordValid($user, $user->getOldPassword())) {
$user->setPassword($this->encoder->encodePassword($user, $user->getPlainPassword()));
$em->flush();
}
}
}
Form view
<form action="{{ form.vars.action }}" method="{{ form.vars.method }}" onsubmit="event.preventDefault(); ajaxSubmit($(this));">
<div class="form-section-title">Change password</div>
<div class="form-col-2">
<div class="input-field">
{{ form_label(form.oldPassword, 'Current password') }}
{{ form_widget(form.oldPassword, { 'attr': {'autocomplete': 'off' }}) }}
</div>
<div class="input-field">
</div>
</div>
<div class="form-col-2">
<div class="input-field">
{{ form_label(form.plainPassword.first, 'New password') }}
{{ form_widget(form.plainPassword.first, { 'attr': {'autocomplete': 'off' }}) }}
</div>
<div class="input-field">
{{ form_label(form.plainPassword.second, 'Repeat new password) }}
{{ form_widget(form.plainPassword.second, { 'attr': {'autocomplete': 'off' }}) }}
</div>
</div>
<input name="{{ form._token.vars.full_name }}" type="hidden" value="{{ form._token.vars.value }}">
<div class="input-field submit-container">
<button class="waves-effect waves-light btn btn-2 close_action">Annuler</button>
<button class="waves-effect waves-light btn btn-1" type="submit">Valider</button>
</div>
</form>
Javascript submit function
function ajaxSubmit(node) {
$.ajax({
type: node.attr("method"),
url: node.attr("action"),
enctype: 'multipart/form-data',
data: new FormData(node[0]),
processData: false,
contentType: false,
cache: false
}).done(function(response, status, xhr) {
//Your code here
}).fail(function(request, status, error) {
console.error(request);
console.error(status);
console.error(error);
});
}
Side note: Should be obvious, but you should use POST and not GET with your AJAX query.
First because GET parameters are as clear as day... It's quite dangerous for a password to be changed like that.
Second because, as soon as your site will be in HTTPS, your POST parameters will be encrypted. Making it really hard to read the content for anyone sniffing around.
And last, avoid to post code in comments, edit your question instead... ;)