Download the PHP package astrotomic/laravel-auth-recovery-codes without Composer

Laravel Auth Recovery-Codes

This package provides Laravel bindings and a Eloquent/Model trait for pragmarx/recovery package. It allows you to easily handle recovery codes, needed for 2FA setups and only care about the app logic.

Installation

You can install the package via composer:

And publish the config via artisan:

Usage

Model

You will have to add the Recoverable trait to your model you want to have recovery codes and should add a json or array cast to the attribute holding the recovery codes.

By default the trait uses a recovery_codes attribute/column - you can change this by setting $recoveryCodesName property:

To set the new recovery codes to your model you should use the setRecoveryCodes() method because this method automatically hashes the recovery codes, if not already hashed. This step is important for security because with this step only the user has access to the recovery codes and no one else. The following snippet is an example of a possible controller action

• generating the codes
• setting and saving the codes on the user model
• responding with the codes to the user (the one and only time anyone can get/read the plaintext recovery codes)

If you want to use the default model attribute without the need to use setRecoveryCodes() method you should add your own accessor and mutator, keep in mind to call the Recoverable::hashRecoveryCodes() method on set and that you have to do the JSON casting by your own.

Migration

After setting up your model you will have to add the new column to your database table, there aren't much requirements - the json column type would only help to prevent invalid content, but the recovery codes JSON isn't really queryable (only an array of hashes), but the column should be nullable if you don't setup recovery codes on user create/register.

Recovery

Now that you have setup your app to generate and store recovery codes you should add the logic to recover an account. The Recoverable trait comes with two methods to help you with this task.

• isValidRecoveryCode() return a bool and tells you if any of the saved recovery codes matches the input
• useRecoveryCode() removes the matching hash from the array and sets the array of remaining recovery codes

Testing

Changelog

Please see CHANGELOG for more information what has changed recently.

Contributing

Please see CONTRIBUTING for details. You could also be interested in CODE OF CONDUCT.

Security

If you discover any security related issues, please check SECURITY for steps to report it.

Credits

• Tom Witkowski
• All Contributors

License

The MIT License (MIT). Please see License File for more information.

Treeware

You're free to use this package, but if it makes it to your production environment I would highly appreciate you buying the world a tree.

It’s now common knowledge that one of the best tools to tackle the climate crisis and keep our temperatures from rising above 1.5C is to plant trees. If you contribute to my forest you’ll be creating employment for local families and restoring wildlife habitats.

You can buy trees at offset.earth/treeware

Read more about Treeware at treeware.earth