src/Identifier/PasswordIdentifier.php
protected function _checkPassword($identity, $password)
    {
        $passwordField = $this->getConfig('fields.' . self::CREDENTIAL_PASSWORD);

        if ($identity === null) {
            $identity = [
                $passwordField => ''
            ];
        }

        $hasher = $this->getPasswordHasher();
        $hashedPassword = $identity[$passwordField];
        if (!$hasher->check($password, $hashedPassword)) {
            return false;
        }

        $this->_needsPasswordRehash = $hasher->needsRehash($hashedPassword);

        return true;
    }
protected function _checkPassword($identity, $password)
    {
        $passwordField = $this->getConfig('fields.' . self::CREDENTIAL_PASSWORD);

        if ($identity === null) {
            $identity = [
                $passwordField => ''
            ];
        }

        $hasher = $this->getPasswordHasher();
        $hashedPassword = $identity[$passwordField];
        if (!$hasher->check($password, $hashedPassword)) {
            return false;
        }

        $this->_needsPasswordRehash = $hasher->needsRehash($hashedPassword);

        return true;
    }
protected function _checkPassword ( $ identity , $ password ) { $ passwordField = $ this -> getConfig ( 'fields.' . self :: CREDENTIAL_PASSWORD ) ; if ( $ identity === null ) { $ identity = [ $ passwordField => '' ] ; } $ hasher = $ this -> getPasswordHasher ( ) ; $ hashedPassword = $ identity [ $ passwordField ] ; if ( ! $ hasher -> check ( $ password , $ hashedPassword ) ) { return false ; } $ this -> _needsPasswordRehash = $ hasher -> needsRehash ( $ hashedPassword ) ; return true ; }
Find a user record using the username and password provided.
Input passwords will be hashed even when a user doesn't exist. This
helps mitigate timing attacks that are attempting to find valid usernames.

@param array|\ArrayAccess|null $identity The identity or null.
@param string|null $password The password.
@return bool
Find a user record using the username and password provided . Input passwords will be hashed even when a user doesn t exist . This helps mitigate timing attacks that are attempting to find valid usernames .