Download the PHP package emargareten/two-factor-laravel without Composer

Two-Factor-Laravel

Two-Factor-Laravel is a package that implements two-factor authentication for your Laravel apps.

If enabled, the user will be required to enter a six digit numeric token during the authentication process. This token is generated using a time-based one-time password (TOTP) that can be retrieved from any TOTP compatible mobile authentication application such as Google Authenticator.

You can also retrieve the current one-time password and send it to the user via SMS/email.

Installation

First, install the package into your project using composer:

Next, you should publish the configuration and migration files using the vendor:publish Artisan command:

Finally, you should run your application's database migrations. This will add the two-factor columns to the users table:

Configuration

After publishing the assets, you may review the config/two-factor.php configuration file. This file contains several options that allow you to customize the behavior of the two-factor authentication features.

Usage

To start using two-factor authentication, you should first add the TwoFactorAuthenticatable trait to your User model:

Enabling Two-Factor Authentication

This package provides the logic for authenticating users using two-factor authentication. However, it is up to you to provide the user interface and controllers for enabling and disabling two-factor authentication.

To enable two-factor authentication for a user, you should call the enableTwoFactorAuthentication method on the user model. This will generate a secret key and recovery codes for the user and store them in the database (encrypted):

Confirming Two-Factor Authentication

After enabling two-factor authentication, the user must still "confirm" their two-factor authentication configuration by providing a valid two-factor authentication code. You should provide a way for the user to do this. For example, you could provide a view that displays the QR code and secret key for the user to scan into their authenticator app:

If you prefer to use a different method for receiving the one-time password, i.e. SMS/email, you can use the getCurrentOtp method on the user model to retrieve the current one-time password:

Note When sending the one-time-password via SMS/email, you should set the window to a higher value, to allow the user to enter the one-time password after it has been sent.

The confirmTwoFactorAuthentication method takes an optional second parameter to specify the two-factor method, this is totally optional, it can be useful if you have multiple methods for receiving the one-time password.

Disabling Two-Factor Authentication

You should also provide a way for the user to disable two-factor authentication. This can be done by calling the disableTwoFactorAuthentication method on the user model:

User Authenticaion

Once the user has confirmed enabling two-factor authentication, each time they log in, they will be redirected to a page where they will be asked to enter a one-time password generated by their authenticator app.

This will redirect the user to the two-factor-challenge.create route.

The TwoFactorAuthenticationChallenged event will be fired if the user is being redirected to the two-factor challenge page, you can listen to this event to add additional logic, for example, you could send the one-time password via SMS/email:

You will need to provide a view for the two-factor-challenge.create route. This view should contain a form where the user can enter the one-time password, you should bind the view in the register method of your AppServiceProvider by calling the TwoFactor::challengeView() method:

Or use a closure to generate a custom response:

The form should be submitted to the two-factor-challenge.store route.

Once the user has entered a valid one-time password, he will be redirected to the intended URL (or to the home route defined in the config file if no intended URL was set).

Recovery Codes

This package also provides the logic for generating and using recovery codes. Recovery codes can be used to access the application in case the user loses access to their authenticator app.

After enabling two-factor authentication, you should redirect the user to a page where they can view their recovery codes. You can also generate a fresh set of recovery codes by calling the generateNewRecoveryCodes method on the user model:

To use the recovery codes, you should add a view for the two-factor-challenge-recovery.create route. This view should contain a form where the user can enter a recovery code. You should bind the view in the register method of your AppServiceProvider by calling the TwoFactor::challengeRecoveryView() method:

The form should be submitted to the two-factor-challenge-recovery.store route.

Testing

Changelog

Please see CHANGELOG for more information on what has changed recently.

Credits

• emargareten
• All Contributors

License

The MIT License (MIT). Please see License File for more information.