Download the PHP package metarush/otp-auth without Composer
On this page you can find all versions of the php package metarush/otp-auth. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.
Download metarush/otp-auth
More information about metarush/otp-auth
Files in metarush/otp-auth
Package otp-auth
Short Description Authentication library using one-time passwords (via email token)
License MIT
Informations about the package otp-auth
metarush/otp-auth
Authenticate and log in your users using one-time passwords (OTP) via email.
Install
Install via composer as metarush/otp-auth
Database setup
In addition to your usual username
and/or email
column, create the ff. columns in your users table.
otpHash
TEXT (255)otpToken
TEXT(12)otpExpire
INT (10)rememberHash
TEXT (255)rememberToken
TEXT (12)
Note: You can use other column names if you want, just set them in the config.
Sample usage
The ff. example is meant to demonstrate the library's functionality in a simple way. It is not required to use this implementation as it is.
_init.php
Create a _init.php
file to be included on top of your script and put the ff.
Initialize builder
Define SMTP servers
You can add as many as you like, the lib will failover to each automatically.
Initialize the library with minimum config
Note: If you want to extend Auth
class and still use the builder, you can pass
your child class in the build()
parameter as string. E.g. ->build('MyAuth');
Auto-login if username is remembered via cookie
login.php
Create a login.php
file and put the ff.
otp.php
Create a otp.php
file and put the ff.
logout.php
Create a logout.php
file and put the ff.
Config methods
You can use the ff. methods in the builder object, before the ->build();
method
setAdminEmails(array);
Array of admin emails that will get error notifications
setAppName(string);
Label of your app on error notifications
setBody(string);
Body of the OTP email. If you set this, you must include the template var {OTP}
.
Default: {OTP}\r\n\r\nNote: This OTP is valid for 5 minutes
setCharacterPool(string);
Pool of characters where the token will be derived from
Default: 0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ
setCookiePrefix(string);
Cookie name prefix used by metarush/otp-auth
Default: MROA_
setCookiePath(?string);
Cookie path used by metarush/otp-auth
Default: /
setDbPass(string);
DB password of your users table
setDbUser(string);
DB username of your users table
setDsn(string);
PDO DSN used to connect to your users table
setEmailColumn(string);
Table column where users' email is stored
Default: email
setFromEmail(string);
From Email of the OTP message
setFromName(string);
From Name of the OTP message
setNotificationFromEmail(string);
If you set an admin email via setAdminEmail()
, you must set a From Email for error notifications
setOtpExpire(int);
OTP expiration in minutes. If you set this, make sure to also change the email message via setBody(string);
to reflect the OTP expiration the email.
Default: 5
setOtpExpireColumn(string);
Table column where OTP expire is stored
Default: otpExpire
setOtpHashColumn(string);
Table column where OTP hash is stored
Default: otpHash
setOtpTokenColumn(string);
Table column where OTP token is stored
Default: otpToken
setRememberCookieExpire(int);
How long "remember me" cookie expires in seconds
Default: 2592000
(30 days)
setRememberHashColumn(string);
Table column name for "remember me" hash
Default: rememberHash
setRememberTokenColumn(string);
Table column name for lookup token for "remember me" cookie
Default: rememberToken
setServers(array);
Array of SmtpServer
objects. See above sample "Define SMTP servers"
setSubject(string);
Subject of the OTP email
Default: Here's your OTP
setTable(string);
Table where usernames will be authenticated
Default: users
setUsernameColumn(string);
Table column name where username is stored
Default: username
setUserIdColumn(string);
Table column name where userId is stored
Default: id
SMTP round-robin mode
You can use round-robin mode to distribute the load to all SMTP hosts when sending OTP email.
To enable round-robin mode, you must use a storage driver to track the last server used to send email.
Available drivers and their config:
files
memcached
Note: Only single server/non-distriubuted memcached is supported at the moment.
redis
Note: Use memcached or redis if available as files is not recommended for heavy usage.
After selecting a driver, set the following in the builder object, before the ->build();
method:
Service methods
authenticated(): bool
Check if user is authenticated
generateToken(int $length): string
$length
Length of token you want to generate.
Generate random token
login(string $username, ?array $userData = []): void
Log in user as authenticated
$username
Username to login
$userData
Optional arbitrary user data defined by you, e.g., firstName, email
logout(): void
Log out user and remove "remember me" cookie
remember(string $username, int $howLong = null): void
Remember username's login in browser
$username
Username to remember
$howLong
How long to remember user in seconds. Default is value is 30 days unless setRememberCookieExpire()
was used in config.
rememberedUsername(?string $cookie = null): ?string
Get remembered username (via cookie) if any.
$cookie
If null, default cookie will be used.
sendOtp(string $otp, string $username, bool $useNextSmtpHost = false, int $testLastServerKey = null): void
Send OTP to user via email
$otp
The OTP to send to user. You can use generateToken()
service method to generate random OTP. Recommended OTP length is at least 8.
$username
Username to send OTP to
$useNextSmtpHost
Set to true
on your next usage of sendOtp()
if you want to use the next SMTP host available relative to the current user. This is useful if the last email is slow to arrive. E.g., Create a "try again" UI then use sendOtp($otp, $username, true)
to send a new OTP using the next SMTP host.
userData(): array
Returns arbitrary user data, if set via login() param
userExist(string $username): bool
Check if user exist
$username
Username to check
validOtp(string $otp, string $username, ?string $testOtpToken = null): bool
Validate OTP
$otp
OTP to be validated
$username
Username associated with the OTP
otpExpired(string $username): bool
Check if OTP is expired
$username
Username associated with the OTP
userId(string $username): int
Returns the userId of $username
$username
Username to get userId
Brute-force protection
We recommended using the metarush/firewall library for login brute-force protection.
All versions of otp-auth with dependencies
metarush/data-mapper Version ^1
metarush/email-fallback Version ^4
laminas/laminas-diactoros Version 2.11.*
aura/session Version ^2.1