Yii2 basic validate password

Question

on my users controller I create to use it like registration, I create

public function actionCreate()
    {
        $model = new Userlogin();
        $model->password = null;

        if ($model->load(Yii::$app->request->post()) ) {

            $model->password = Yii::$app->getSecurity()->generatePasswordHash($model->password);                

            $model->save();
            return $this->redirect(['view', 'id' => $model->uid]);
        } else {
            return $this->render('create', [
                'model' => $model,
            ]);
        }
    }

It's work , it hash the password , but I don't know how to validate the password and make it work in login I did read that I have to use this

if (Yii::$app->getSecurity()->validatePassword($password, $hash)) {
    // all good, logging user in
} else {
    // wrong password
}

but I don't know how to use it or where I have to use it

Answer 1

create new action , name it login be sure to get user hash password from db

public function actionLogin() {


    $hash = User::find()->where('username='.$_POST['username'])->One();

    if (Yii::$app->getSecurity()->validatePassword($_POST['password'], $hash->password_hash)) {
        // all good, logging user in
    } else {
        // wrong password
    }

    }

Answer 2

I found the solution for someone if he is in the same situation

in create action

public function actionCreate()
    {
        $model = new Userlogin();

        if ($model->load(Yii::$app->request->post()) ) {

            $model->password = Yii::$app->security->generatePasswordHash($model->password);

            $model->save();
            return $this->redirect(['view', 'id' => $model->uid]);
        } else {
            return $this->render('create', [
                'model' => $model,
            ]);
        }
    }

and in user model change

/**
     * Validates password
     *
     * @param string $password password to validate
     * @return bool if password provided is valid for current user
     */
    public function validatePassword($password)
    {
        return $this->password === $password;
    }

to

/**
     * Validates password
     *
     * @param string $password password to validate
     * @return bool if password provided is valid for current user
     */
    public function validatePassword($password)
    {
        return Yii::$app->getSecurity()->validatePassword($password, $this->password);
    }

this solution from : https://stackoverflow.com/a/29508651/6562828

I'm using Userlogin as model for user but if anyone is using User model it's in user model

Answer 3

IMHO, the code :

if (Yii::$app->getSecurity()->validatePassword($password, $hash)) {
    // all good, logging user in
} else {
    // wrong password
}

can be used for POST method when user do login, and inside "// all good, logging user in", you will do something with Web Session, saving session for specify user, then yay, user logged in,

after that, you can use Session for checking, "is user are logged in ?", etc,

here some good link about Yii Session Handling : http://www.yiiframework.com/doc-2.0/guide-runtime-sessions-cookies.html