Skip to content

fix(cryptography): support php builds without argon2#2165

Draft
WarLikeLaux wants to merge 1 commit into
tempestphp:3.xfrom
WarLikeLaux:fix/hashing-without-argon2
Draft

fix(cryptography): support php builds without argon2#2165
WarLikeLaux wants to merge 1 commit into
tempestphp:3.xfrom
WarLikeLaux:fix/hashing-without-argon2

Conversation

@WarLikeLaux

Copy link
Copy Markdown

HashingAlgorithm took its case values from PASSWORD_ARGON2ID / PASSWORD_BCRYPT, but PASSWORD_ARGON2ID only exists on PHP builds compiled with Argon2. Without it the enum can't load, which also kills the bcrypt path (BcryptConfig references HashingAlgorithm::BCRYPT) and the default hashing.config.php (new ArgonConfig()) hits a fatal on boot before any bcrypt override applies. The enum now uses the literal strings behind those constants ('argon2id', '2y') - the same values password_hash() accepts and password_get_info() returns.

The default config falls back to bcrypt only when Argon2 isn't available, so Argon2id stays the default on every build that supports it and the framework boots on the ones that don't.

Fixes #2147

@WarLikeLaux WarLikeLaux requested a review from innocenzi as a code owner June 7, 2026 17:44
@innocenzi

Copy link
Copy Markdown
Member

@brendt would we be fine with a breaking change that would use bcrypt by default?

We can't automate config changes unfortunately, and this fallback implementation is not really ideal.

As far as I know, Argon2 support is in most default PHP installations, so we can also just specify in the docs that it's required for Tempest to run by default

@innocenzi innocenzi marked this pull request as draft June 8, 2026 09:40
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

tempest/cryptography has undocumented hard dependency on Argon2

2 participants