In an earlier tip, I showed a validation rule that rejects any password over 72 bytes, so bcrypt never silently truncates it.
That is a good approach, but Laravel also offers a config option that goes a step further and throws an exception if bcrypt would ever have to truncate a password being hashed.
This is the sort of thing that "shouldn't" ever happen, but I'd sleep better knowing it would fail loudly if somehow it ever slipped through.
Adding one env setting will activate this check:
BCRYPT_LIMIT=72
The framework's default hashing config already reads this variable, so you don't need to publish config/hashing.php.
Without it, the limit is null, and you get the old silent behavior.
Like the validation rule, it measures with strlen(), so it counts bytes the same way bcrypt does.
With both in place, the validation rule gives users a friendly message, and the config limit turns anything that skips validation, like a seeder or console command, into a loud failure instead of a quiet security hole.
Here to help,
Joel
P.S. Tracking down every place an app hashes a value is exactly the kind of thing we look for in a code review.
