I've got an issue regarding the hash of our user passwords. It seems that our password hash changes after some deployment of our dokerized php application making our user login check invalid whereas the password didn't change.
After login a valid hash is created in our db using symfony UserPasswordHasherInterface->hashPassword which is based on argon2i algorithm.
The problem that appears from time to time after deployment is that the hash do not valid the user password anymore and we can't figure out why. I've compared the hash before and after deployment that triggered the issue thanks to our sentry application and they are actually different.
I first thought that the argon2i algo was based on some server hardware variables since our app is deployed through kubernetes among up to 3 pods.
But according to the doc and the structure of the hash it's not : $argon2i$v=19$m=65536,t=4,p=1$$
- $argon2i => encoding algorithm
- $v=19 => algorithm version
- $m=65536,t=4,p=1 => (memory cost, time, and threads usage)
- $<salt>
- $<hash>
Another noticeable info is that we made a php upgrade from 7.4 to 8.1 and symfony from 4.4 to 5.4 recently and we didn't face this issue before. It's the same algorithm (argon2i) that we have before so no migration has been done on the hash but maybe i've missed something.
I'm running out of trail for resolving this issue and since it happens in production any help would be very appreciated.