FriendsOfSymfony/FOSUserBundle — Issue #395: Removing the custom EncoderFactory from the bundle
Author: stof
Created: 2011-11-05 13:10:45+00:00
State: open
Labels: RFC

I would like to remove the custom EncoderFactory from the bundle. It has several issues:

- it makes it totally impossible to use a different encoder for the User class provided by FOSUserBundle (many people complained about it, see #388 and #337 for instance)
- the User instance **must** have the algorithm set in it, even when the default one is used. This is done by the UserManager when using the ``createUser`` method to instantiate the User but it is a common WTF when people instantiate it by hand with ``new User``.

So here is my suggestion:

- remove the EncoderFactory from the bundle
- remove the ``algorithm`` field from the User class and the related methods in the interface

There is a BC break here as people will now have to register an encoder for the FOSUB class in the SecurityBundle configuration which was not needed (and not used) previously. The needed configuration to keep the encoded password working (for people using the default values in FOSUB) is

```yaml
security:
encoders:
"FOS\UserBundle\Model\UserInterface":
algorithm: sha512
encode_as_base64: false
iterations: 1
```

For people wanting the feature of changing the encoder on an instance basis, I created https://github.com/stof/StofAdvancedEncoderBundle which provides the feature in a flexible way (it supports using any provider, not only the MessageDigestPasswordEncoder) and for any User implementation (totally decoupled from FOSUB)

What are your thoughts about it ?

Note: a 1.1 tag of the bundle will be created with all the new features since 1.0 (Propel support) before doing this BC break.