Download the PHP package nero990/google2fa-laravel without Composer

Google2FA for Laravel

Google Two-Factor Authentication Package for Laravel

Google2FA is a PHP implementation of the Google Two-Factor Authentication Module, supporting the HMAC-Based One-time Password (HOTP) algorithm specified in RFC 4226 and the Time-based One-time Password (TOTP) algorithm specified in RFC 6238.

This package is a Laravel bridge to Google2FA's PHP package.

The intent of this package is to create QRCodes for Google2FA and check user typed codes. If you need to create backup/recovery codes, please check below.

Recovery/Backup codes

if you need to create recovery or backup codes to provide a way for your users to recover a lost account, you can use the Recovery Package.

Demos, Example & Playground

Please check the Google2FA Package Playground.

Here's an demo app showing how to use Google2FA: google2fa-example.

You can scan the QR code on this (old) demo page with a Google Authenticator app and view the code changing (almost) in real time.

Compatibility

Before Google2FA 2.0 (Laravel 5.1) you have to install pragmarx/google2fa:~1.0, because this package was both a Laravel package and a PHP (agnostic).

Demo

Click here to see the middleware demo:

Installing

Use Composer to install it:

composer require pragmarx/google2fa-laravel

Installing on Laravel

Laravel 5.5 and above

You don't have to do anything else, this package autoloads the Service Provider and create the Alias, using the new Auto-Discovery feature.

Laravel 5.4 and below

Add the Service Provider and Facade alias to your app/config/app.php (Laravel 4.x) or config/app.php (Laravel 5.x):

Publish the config file

Using It

Use the Facade

In Laravel you can use the IoC Container

Middleware

This package has a middleware which will help you code 2FA on your app. To use it, you just have to:

Add the middleware to your Kernel.php:

Using it in one or more routes:

QRCode Backend

There are three available: imagemagick (default), svg and eps.

You can change it via config:

Or runtime:

Configuring the view

You can set your 'ask for a one time password' view in the config file (config/google2fa.php):

And in the view you just have to provide a form containing the input, which is also configurable:

Here's a form example:

One Time Password Lifetime

Usually an OTP lasts forever, until the user logs off your app, but, to improve application safety, you may want to re-ask, only for the Google OTP, from time to time. So you can set a number of minutes here:

Keep in mind that this uses the Laravel sessions in the background. If this number exceeds the value set in config('session.lifetime') you will still be logged out, even if your OTP lifetime has not expired.

And you can decide whether your OTP will be kept alive while your users are browsing the site or not:

Manually logging out from 2Fa

This command wil logout your user and redirect he/she to the 2FA form on the next request:

If you don't want to use the Facade, you may:

Throttling / Lockout after X attempts

Unless you need something really fancy, you can probably use Laravel's route throttle middleware for that:

Stateless usage

You can also use a stateless middleware:

Events

The following events are fired:

• EmptyOneTimePasswordReceived
• LoggedOut
• LoginFailed
• LoginSucceeded
• OneTimePasswordExpired
• OneTimePasswordRequested

Documentation

Check the ReadMe file in the main Google2FA repository.

Tests

The package tests were written with phpspec.

Author

Antonio Carlos Ribeiro

License

Google2FA is licensed under the MIT License - see the LICENSE file for details

Contributing

Pull requests and issues are more than welcome.