New hashing of password - redirect users to password reset on login attempt

Question

Here is an "update" In the previous version of my project we didn't have any proper hashing on password. So I want to use Laravel's hashing, and invite the users to make a new password.

What I have is a new password column in my User table. If when the user tries to log in, the new password doesn't exist (empty column), we automatically do a "reset password." I would like to know where to do this verification:

class LoginController extends Controller
{
    public function login(Request $request)
    {
        //check if the user has an empty password
        //if yes
        redirect('/password/reset');

        //else
        //use normal login function
    }
}

Is that the correct place? And do I need to rewrite all login content in the "else" ? (sorry this is a basic question)

Answer 1

I suggest that you create a middleware ( EnsurePasswordIsAdded as an example ) for your case and not include the verification process in a controller, because a controller usually contains functions that interact either a database or an external API to provide a response to the user which is not the case for you, you're just filtering/verifying the request.

here's the documentation link about middlewares in Laravel:

https://laravel.com/docs/5.8/middleware

here's a code suggestion:

 public function handle($request, Closure $next)
 {
    if ( !User::find($request->email)->hasPassword() ) {
        return redirect('password-reset')->with('email',$request->email);
    }
    return $next($request);
 }