Skip to content

Document breaking change in password rehashing if custom password field #9901

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
taylorotwell merged 2 commits into from
Sep 19, 2024
Merged

Document breaking change in password rehashing if custom password field #9901

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
2c1d2a6
Document breaking change in password rehashing if custom password field
sgilberg Sep 17, 2024
c9b8a4b
Update upgrade.md
taylorotwell Sep 19, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 8 additions & 2 deletions upgrade.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -126,9 +126,15 @@ However, we do **not recommend** that Laravel 10 applications upgrading to Larav
<a name="password-rehashing"></a>
#### Password Rehashing

Laravel 11 will automatically rehash your user's passwords during authentication if your hashing algorithm's "work factor" has been updated since the password was last hashed.
**Likelihood Of Impact: Low**

Laravel 11 will automatically rehash your user's passwords during authentication if your hashing algorithm's "work factor" has been updated since the password was last hashed.

Typically, this should not disrupt your application; however, if your `User` model's "password" field has a name other than `password`, you should specify the field's name via the model's `authPasswordName` property:

protected $authPasswordName = 'custom_password_field';

Typically, this should not disrupt your application; however, you may disable this behavior by adding the `rehash_on_login` option to your application's `config/hashing.php` configuration file:
Alternatively, you may disable password rehashing by adding the `rehash_on_login` option to your application's `config/hashing.php` configuration file:

'rehash_on_login' => false,

Expand Down