After validating the password, you can hash a password in the beforeSave callback of your model:
class User extends AppModel {
public function beforeSave($options = array()) {
if (isset($this->data[’User’][’password’])) {
$this->data[’User’][’password’] = AuthComponent::password($this->data[’User’][’}
return true;
}
}
You don’t need to hash passwords before calling $this->Auth->login(). The various authentication
objects will hash passwords individually. If you are using Digest authentication, you should not use
AuthComponent::password() for generating passwords. See below for how to generate digest hashes.
Hashing passwords for digest authentication Because Digest authentication requires a password hashed
in the format defined by the RFC, in order to correctly hash a password for use with Digest authentication
you should use the special password hashing function on DigestAuthenticate. If you are going to
be combining digest authentication with any other authentication strategies, it’s also recommended that you
store the digest password in a separate column, from the normal password hash:
class User extends AppModel {
public function beforeSave($options = array()) {
// make a password for digest auth.
$this->data[’User’][’digest_hash’] = DigestAuthenticate::password(
$this->data[’User’][’username’], $this->data[’User’][’password’], env(’SERVER_NAME’)
);
return true;
}
}
Passwords for digest authentication need a bit more information than other password hashes, based on the
RFC for digest authentication. If you use AuthComponent::password() for digest hashes you will not be
able to login.
Note: The third parameter of DigestAuthenticate::password() must match the ‘realm’ config value
defined when DigestAuthentication was configured in AuthComponent::$authenticate. This defaults to
env(’SCRIPT_NAME). You may wish to use a static string if you want consistent hashes in multiple
environments.
Manually logging users in Sometimes the need arises where you need to manually log a user in, such as
just after they registered for your application. You can do this by calling $this->Auth->login() with
the user data you want to ‘login’:
public function register() {
if ($this->User->save($this->request->data)) {
$id = $this->User->id;
$this->request->data[’User’] = array_merge($this->request->data[’User’], array(’id’ $this->Auth->login($this->request->data[’User’]);