Cakephp 2.x Authentication Login not working

Question

I started off creating a single form to create users/password records in my database. I realize that passwords being created were not being encrypted automatically so i grabbed some sample code from the internet to encrypt my passwords when user records are created.

The problem is my users still cannot log in.

Here is the User model, the code is supposed to sha256 the password (when creating the user record)

public function beforeSave($options = array()) {
    if (!empty($this->data['User']['password'])) {
        $passwordHasher = new SimplePasswordHasher(array('hashType' => 'sha256'));
        $this->data['User']['password'] = $passwordHasher->hash(
            $this->data['User']['password']
        );
    }
    return true;
}

This seems to result in the password being saved in the database as a string of encrypted looking gibberish. Hence i assume the encryption is working!

And now we move on to the login form.

Here is the LoginsController login code that displays login.ctp and processes the login.

public function login() {
    if ($this->request->is('post')) {
        if ($this->Auth->login()) {
            $this->redirect($this->Auth->redirect());
        } else {
            $this->Session->setFlash('Your username/password combination was incorrect');
        }
    }
}

Here is my login.ctp

<h2>Login</h2>

<?php

echo $this->Form->create();
echo $this->Form->input('username');
echo $this->Form->input('password');
echo $this->Form->end('Login');
?>

Since I have sha256 hashtype specified in my earlier User Model in the beforeSave function, I also then added into my AppController an Auth component 'authenticate' array to specify 'hashType' => 'sha256'. I assume this instructs Cakephp which hashtype to use when a user tries to log in.

public $components = array(
    'DebugKit.Toolbar',
    'Session',
    'Auth'=>array(
        'loginRedirect'=>array('controller'=>'logins', 'action'=>'login'),  
        'logoutRedirect'=>array('controller'=>'logins', 'action'=>'logout'), 
        'authError'=>'You cannot access that page', //Error message whenever someone access a page without auth
        'authorize'=>array('Controller') //Where in our application that authorization will occur

    ),
    'authenticate' => array(
        'Form' => array(
            'passwordHasher' => array(
                'className' => 'Simple',
                'hashType' => 'sha256'
            )
        )
    )
);

I realize whether or not I have this 'hashType' => 'sha256' in my AppController or not, the login does not work. When attempting to login, it always results in message "Your username/password combination was incorrect" which is from LoginsController login action.

Questions

1) How can I troubleshoot the user not being able to log in?

2) Why are there so many ways (i found on various sites) to encrypt password (e.g using alias, using Security::hash, and using SimplePasswordHasher, etc)

3) What is the default encryption expected by Auth component?

Thanks!

Apologies. The actual error i'm getting now is that i cannot even get to the login screen because it is saying "Error: authenticateComponent could not be found. Error: Create the class authenticateComponent below in file: app\Controller\Component\authenticateComponent.php" — aDvo

mark mark · Accepted Answer · 2014-04-09T11:16:58

you need to pay attention to the error messages (they are usually pretty descriptive) and your casing (that is also very important when coding).

'authenticate' => array() !== 'Authenticate' => array()

The latter is the name of the component and needs to exactly match it.

Regarding 2) Some are deprecated ways of doing it. Using the PasswordHasher is the recommended future proof approach.

3) sha1 (as you can see by looking into the core code) for cake2

PS: If you are smart you are now using the cake3 default which is blowfish. Then you are all set for the far future.

Cakephp 2.x Authentication Login not working

3 Answers