Symfony / FOSuserBundle : salt are null?

Question

I'm using :

• Symfony 3.4
• FOSUserBundle 2

FOSuserbundle is well installed and works like a charm. I noticed that in my database, in the users table, the column "salt" is always empty :

Below is an extract from my security.yml file :

security:
    encoders:
        FOS\UserBundle\Model\UserInterface: bcrypt

For the record, I added the 2 users with the command "fos:user:create".

Is this normal ?

Answer 1

Yes this is normal, because with using bcrypt the salt is contained in the hashed password.

Reference: https://php.net/manual/password.constants.php#constant.password-bcrypt

salt (string) - to manually provide a salt to use when hashing the password. Note that this will override and prevent a salt from being automatically generated.

If omitted, a random salt will be generated by password_hash() for each password hashed. This is the intended mode of operation and as of PHP 7.0.0 the salt option has been deprecated.

---

You can see the behavior in the source:

// FOSUserBundle/Util/PasswordUpdater.php [Line 43]

if ($encoder instanceof BCryptPasswordEncoder) {
    $user->setSalt(null);
}