Implement proper serialization of passwords for User entity

Author: codedmonkey

src/Doctrine/Entity/User.php

@@ -51,6 +51,18 @@ class User implements UserInterface, PasswordAuthenticatedUserInterface, TwoFact
     #[Column(nullable: true)]
     private ?string $totpSecret = null;
 
+    public function __serialize(): array
+    {
+        // todo move plain password to DTO
+        $this->clearPlainPassword();
+
+        // Prevent storing the hashed password directly in the user session
+        $data = (array) $this;
+        $data["\0" . self::class . "\0password"] = hash('crc32c', (string) $this->password);
+
+        return $data;
+    }
+
     public function getId(): ?int
     {
         return $this->id;
@@ -124,6 +136,11 @@ public function setPlainPassword(string $password): self
         return $this;
     }
 
+    public function clearPlainPassword(): void
+    {
+        $this->plainPassword = null;
+    }
+
     public function getTotpSecret(): ?string
     {
         return $this->totpSecret;
@@ -144,11 +161,6 @@ public function getSalt(): ?string
         return null;
     }
 
-    public function eraseCredentials(): void
-    {
-        $this->plainPassword = null;
-    }
-
     public function isAdmin(): bool
     {
         return $this->role->isAdmin();

src/Doctrine/EventListener/UserListener.php

@@ -39,6 +39,6 @@ private function hashPassword(User $user): void
         $password = $this->passwordHasher->hashPassword($user, $user->getPlainPassword());
         $user->setPassword($password);
 
-        $user->eraseCredentials();
+        $user->clearPlainPassword();
     }
 }