Download the PHP package mmockelyn/laravel-otp without Composer

Laravel OTP

This package allows you to secure your resources with one time password access (otp).

Example Usage:

Contents

• Installation
• Configuration
• Usage
  • Basic Usage
  • Advanced Usage
  • Deeper Knowledge
• Changelog
• Testing
• Credits

Installation

1- Add the package to your dependencies.

2- Register the package in your config/app.php file:

only if you your auto package discovery off.

3- Publish the components:

Publishes a migration, two views and a configuration file.

4- Apply the migrations:

_Will create a table called otp_tokens to store generated token information._

5- Register the routes:

These routes are required if you are planning to use otp middleware.

In your RouteServiceProvider, append the following line inside the map method:

6- Register the route middleware:

Register the otp route middleware inside your App\Http\Kernel.

Configuration

This package comes with a set of handy configuration options:

password_generator: The password generator option allows you to decide which generator implementation to be used to generate new passwords.

Available built-in options: string, numeric and numeric-no-0. default: string

table: The name of the table to be used to store the otp tokens.

default: otp_tokens

expiry_time: The expiry time of the tokens in minutes.

default: 15

default_channels: The default notification channels of the token notification.

Usage

Basic Usage

After configuring your instance of the package, you can use the built-in otp middleware alias to secure your endpoints:

This middleware will redirect any unauthenticated request to the otp/create endpoint which we have registered in the installation process:

• A password will be generated using the configured password generator.
• The authenticated user will be notified about the password via the configured notification channel.
• The user will see a form to submit their password.
• You can change the appearance of the view under your resources/views/otp directory, modifying create.blade.php file.
• After a successful authentication; the user will be redirected back to the original route they requested at the first step.
• The redirected request will also include the otpToken() instance being used by the user.

Advanced Usage

Adding the notification channel method:

If you are not using the mail channel, or your notification channel is expecting a method different than mail or sms, you can register your own method like:

Don't forget to change your configuration file as well.

Using your own password generator:

To add your own password generator implemetation, you can call addPasswordGenerator method on Otp service like:

If you need more power, you can also create your own password generator class too:

You can register you password generator like the previous one:

Don't forget to change your configuration file as well.

Determining the otp channel per notifiable

The Notification class checks otpChannels existence inside the notifiable being notified. If so, this method is being called to determine which notification channel is going to be used to notify the notifiable.

Deeper Knowledge:

The public API consists of two main components: OtpService and the Token which generally is being returned by the service.

Otp Service:

If you are planning to create your own API or the basic functionality is not enough four you, you can use the Otp Service API:

Chencking the validity of a given token:

Setting the password generator:

Creating a new token for a given user:

Retrieveing an existing token from the storage by the given plain password:

Retrieveing an existing token from the storage by the given cipher text (token):

Changing the behavior of the Service

The package comes with a ServiceProvider which registers the Otp service to your application's container.

The Otp orchestrates the method calls made to the 3 interface implementations below.

• PasswordGeneratorManagerInterface
• EncryptorInterface and
• TokenInterface

You can write your service provider and register the OtpService with your version of the dependencies.

Note: Because the token class is being used with static calls, you have to send the fully qualified name of your TokenInterface implementation.

Token API:

Getting the attributes of the token:

Invalidate a token:

e.g.

Extend or refresh the token expiry time:

e.g.

Create a new token:

e.g.

Retrieve a token from the storage by the given attributes:

Make sure that the attributes you provided will return a unique token.

e.g.

Convert the token to a notification:

e.g.

Changelog

Please see CHANGELOG for more information what has changed recently.

Testing

Credits

• Hilmi Erdem KEREN
• Berkay Güre