Drupal automagically changing password hash This issue happened on my  localhost machine while in development but I thought nothing of it since I had multiple drupal projects and was jumping to one another constantly - I figure it was cookies or what not and was constantly resetting my passwords. However I recently went into production and this issue is still occuring.

I have a new drupal site for which I created 2 new users for testing purposes. I realized that after 24 hours or so, the login credentials for these users would not work and I would get :


  Sorry, unrecognized username or password. Have you forgotten your password?


I use these accounts to log in via browsers other than my main one and test the user interface of my production site. After each use I make sure I logout.

I made sure to configure the  $cookie_domain in my settings.php and chmod the file properly but the issue still occurs.

Recently I started tracking the hashes in the user table and low and behold they are magically changing without any human intervention ! What can be causing that ?

Oddly enough, this issue does not happen with the admin account (#1) for which I have yet to logout, and another account which was created but never used. In both cases user_check_password() returns true.

Clearing cache does nothing.

I am running the latest core with latest version of all contrib. modules.
I use SSL everywhere
I have APC and memcache running.
I use a mix of MongoDB and MySQL
The issue was with my own code.

I would load the user object every day to perform operations and change some fields value.

Instead of just passing the new fields as the second argument of user_save(), I would pass the newly changed user object cast as an array, which was causing my password hash to be re-hashed on every call of this function.