Laravel & Meteor password hashing -

i have 2 applications, 1 in laravel 5.2 , 1 in meteor. want collect hashes passwords compatible both platforms.

the database stores hashes separately

• password laravel.
• meteor_password meteor.

both platforms use bcrypt 10 rounds default, meteor appears sha256 plain password before bcrypt.

if meteor creates password hash abc, can sha256 plain password, , compare abc using laravel's internals, i.e. auth::attempt()

$sha256 = hash('sha256', $request->get('password'), false); 

this works. laravel authenticates user.

however, if register new user in laravel, , store hash meteor_password, when authenticating against hash in meteor, fails error message "login forbidden". this error appears mean incorrect credentials.

i'm creating hash in same way did when verified in laravel.

$meteor_password = bcrypt(hash('sha256', $plain, false)); 

it seems strange it'd work 1 way , not other assume i'm missing something.

in 2011, bug discovered in php's bcrypt implementation, changed original 2a version indicator 2x , 2y, used today, indicate password hashed fixed version.

therefore, hash generated php's 2y should identical 1 generated node's 2a.

the prefix should changed in order correctly processed npm module (used meteor), does not acknowledge 2y.

$meteor_password = bcrypt(hash('sha256', $plain, false)); // replace useing like: $meteor_password = str_replace('$2y', '$2a', $meteor_password); // or $meteor_password[2] = 'a';