Merge branch '7.4' into 8.0

* 7.4:
  Minor tweaks
  docs(SecurityBundle): register alias for argument for password hasher

Author: javiereguiluz

security.rst

@@ -461,8 +461,8 @@ You can also manually hash a password by running:
 
     $ php bin/console security:hash-password
 
-Read more about all available hashers and password migration in
-:doc:`security/passwords`.
+Read more about all available hashers (including specific hashers) and password
+migration in :doc:`security/passwords`.
 
 .. _firewalls-authentication:
 .. _a-authentication-firewalls:

security/passwords.rst

@@ -256,6 +256,64 @@ You can customize the reset password bundle's behavior by updating the
 ``reset_password.yaml`` file. For more information on the configuration,
 check out the `SymfonyCastsResetPasswordBundle`_  guide.
 
+Injecting a Specific Password Hasher
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+In some cases, you may define a password hasher in your configuration that is
+not tied to a user class. For example, you might use a separate hasher for
+password recovery codes or API tokens.
+
+With the following configuration:
+
+.. code-block:: yaml
+
+    # config/packages/security.yaml
+    security:
+        password_hashers:
+            recovery_code: 'auto'
+
+        firewalls:
+            main:
+                # ...
+
+You can inject the ``recovery_code`` password hasher into any service. However,
+you can't rely on standard autowiring, as Symfony doesn't know which specific
+hasher to provide.
+
+Instead, use the ``#[Target]`` attribute to explicitly request the hasher by
+its configuration key::
+
+    // src/Controller/HomepageController.php
+    namespace App\Controller;
+
+    use Symfony\Component\DependencyInjection\Attribute\Target;
+    use Symfony\Component\PasswordHasher\PasswordHasherInterface;
+
+    class HomepageController extends AbstractController
+    {
+        public function __construct(
+            #[Target('recovery_code')]
+            private readonly PasswordHasherInterface $passwordHasher,
+        ) {
+        }
+
+        #[Route('/')]
+        public function index(): Response
+        {
+            $plaintextToken = 'some-secret-token';
+
+            // Note: use hash(), not hashPassword(), as we are not using a UserInterface object
+            $hashedToken = $this->passwordHasher->hash($plaintextToken);
+        }
+    }
+
+When injecting a specific hasher by its name, you should type-hint the generic
+:class:`Symfony\\Component\\PasswordHasher\\PasswordHasherInterface`.
+
+.. versionadded:: 7.4
+
+    The feature to inject specific password hashers was introduced in Symfony 7.4.
+
 .. _security-password-migration:
 
 Password Migration