我可以使用Sytrfony 4上的Doctrine（findOneBy（））通过用户名和密码获取用户吗？

Question

I want to get a user by their username and password using Doctrine ( findOneBy() method), on Symfony4.

security:
    encoders:
        App\Entity\User:
        algorithm: argon2i

$username= $request->request->get('username');
$password = $request->request->get('password');
$user= $this->em->getRepository(User::class)->findOneBy([
    'username'=>$username,
    'passsword'=>$password
]);
return  new Response($user);

Answer 1

The correct way to do this is to fetch the user by their username, and then verify the password using Symfony's password encoder.

Eg:

public function __construct(UserPasswordEncoderInterface $encoder) {
    $this->encoder = $encoder;
}

public function yourAction(Request $request) {
    $username = $request->request->get('username');
    $password = $request->request->get('password');
    $user     = $this->em->getRepository(User::class)->findOneBy(['username'=>$username]);

    if ($user === null) {
        // user not found
        // throw exception or return error or however you handle it
    }

    if (! $this->encoder->isPasswordValid($user, $password)) {
        // invalid password
        // throw exception, or return error, or however you handle it
    }

//...
}

Remember that you would need to add the use Symfony\\Component\\Security\\Core\\Encoder\\UserPasswordEncoderInterface; statement at the top of your script.

Answer 2

technically, you can find a user if you know the username and the passwort (hash).

However, since the hash usually is salted with a random salt, you can't find a user by username and plain text password.

The clean approach here is to fetch the user by username and check the password (via password_verify or the symfony version (or see yivi's answer )).

Answer 3

I think to pass multiple criteria, you have to use the "findBy" method

$username= $request->request->get('username');
$password = $request->request->get('password');
$user= $this->em->getRepository(User::class)->findBy(
             [
               'username' => $username,
               'password'=> $password
             ],
             [], 
             1
);
return  new Response($user);

You can find detail explanation of doctrine methods here

Answer 4

You could create a new method inside your repository (App/Repository/UserRepository.php) where you can give username and password too and send back the result.

public function getUserByUsernameAndPassword(string $username, string $password)
{
    $qb = $this->createQueryBuilder('u')
      ->andWhere('u.username = :username')
      ->andWhere('u.password LIKE :password')
      ->setParameter('username',  $username )
      ->setParameter('password',  $password )
      ->getQuery();

    return $qb->getResult();
}