title: CakePHP - How do I implement blowfish hashing for passwords?
body: <p>Struggling to find answers to a few basic questions about using Blowfish in Cake 2.4.</p>
  
  <p><strong>AppController.php</strong></p>
  
  <pre><code>public $components = array(
      'Auth' =&gt; array(
          'authenticate' =&gt; array(
              'Form' =&gt; array(
                  'fields' =&gt; array(
                      'username' =&gt; 'email'
                  ),
                  'passwordHasher' =&gt; 'Blowfish'
              )
          )
      ),
      'Cookie',
      'Session'
  );
  </code></pre>
  
  <p>What now? How do I log in?</p>
  
  <p><strong>UsersController.php</strong></p>
  
  <pre><code>public function login() {
  
      if (!empty($this-&gt;request-&gt;data)) {
  
          if ($this-&gt;Auth-&gt;login()) {
              $this-&gt;redirect($this-&gt;Auth-&gt;redirectUrl());
          }
  
      }
  }
  </code></pre>
  
  <p>What do I need to add to this? I'm getting the following error if I try to log in:</p>
  
  <p><strong><em>Warning (512):</strong> Invalid salt:  for blowfish Please visit <a href="http://www.php.net/crypt" rel="noreferrer">http://www.php.net/crypt</a> and read the appropriate section for building blowfish salts. [CORE/Cake/Utility/Security.php, line 285]</em></p>
  
  <p>Do I need to salt the password before attempting login, and if so, which method do I use and what is the best thing to use for the salt? Does Cake automatically try to use the salt from the <strong>core.php</strong> config file for all users?</p>
  
  <p>I'm confused mainly because I don't know which parts of using blowfish in a standard PHP way CakePHP is trying to do automatically for me.</p>