Download the PHP package rainwaves/lara-auth-suite without Composer

On this page you can find all versions of the php package rainwaves/lara-auth-suite. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.

FAQ

After the download, you have to make one include require_once('vendor/autoload.php');. After that you have to import the classes with use statements.

Example:
If you use only one package a project is not needed. But if you use more then one package, without a project it is not possible to import the classes with use statements.

In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
Some PHP packages are not free to download and because of that hosted in private repositories. In this case some credentials are needed to access such packages. Please use the auth.json textarea to insert credentials, if a package is coming from a private repository. You can look here for more information.

  • Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
  • To use Composer is sometimes complicated. Especially for beginners.
  • Composer needs much resources. Sometimes they are not available on a simple webspace.
  • If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
  • Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Please rate this library. Is it a good library?

Example code of rainwaves/lara-auth-suite

Informations about the package lara-auth-suite

Rainwaves Lara Auth Suite

Modern, flexible authentication for Laravel APIs & SPAs.

Plug-and-play authentication for Laravel 10/11/12/13, supporting both API token auth (Sanctum) and session-based auth for SPAs — with password resets, backend-enforced Two-Factor Authentication (Email OTP + TOTP), recovery codes, and full role/permission support.

Overview

Rainwaves/Lara Auth Suite gives you full authentication without writing boilerplate:

Ideal for:

Demo Applications

Backend (Laravel)

Reference backend implementation using the package:

https://github.com/Magnificent-Big-J/lara-auth-suite-demo

Frontend (Nuxt SPA)

Full SPA login + 2FA flow:

https://github.com/Magnificent-Big-J/lara-auth-suite-nuxt-demo

Features

Feature Status Description
Sanctum PAT login Done Token-based API authentication
Session authentication Done Laravel guard + CSRF protection
Password reset (email) Done Full reset flow with throttle
2FA: Email OTP Done Secure email verification codes
2FA: TOTP (Authenticator App) Done Google Authenticator / Authy / 1Password
2FA enforcement Done Enforced on protected routes (backend-driven)
TOTP replay protection Done last_used_counter prevents counter reuse
Recovery codes Done 8-code offline fallback for locked-out TOTP users
Security throttles Done Login/reset/2FA rate limiting
Pending auth manager Done Purpose-bound (login-challenge vs. MFA-setup) session-less state bridge
Feature flag gating Done Disable unused auth features at the route level
Mandatory MFA setup Done enforcement: required routes unenrolled users into setup, never silent access
Password-reset revocation Done Reset revokes tokens, invalidates sessions, invalidates pending 2FA contexts
Recent-password confirmation Done TTL-bound window so sensitive 2FA actions don't need password on every request
Independent rate limits Done Separate per-account and per-IP buckets, can't be bypassed by rotating either
Finite, scoped tokens Done 7-day expiry and auth:read-only abilities by default
Security event coverage Done Full event set with enforced payload redaction (no secrets ever leak)
Config validator Done php artisan authx:check [--production]
Trusted devices Planned Device remembering
Token/session/device mgmt Planned Revoke, audit

Requirements

Laravel PHP Sanctum
11 / 12 / 13 8.2 / 8.3 / 8.4 4.x / 5.x

Sanctum is required only when token mode is enabled (authx.mode: token or both) — session-only installs don't need it. The package checks this at boot and fails clearly if token mode is on without Sanctum installed.

Breaking Changes in v2.1.0

Read this section carefully before upgrading from v2.0.x. See CHANGELOG.md for the full list; the essentials:

ITwoFactorRequirement::shouldRequire(): bool is now decide(): TwoFactorRequirementResult. The boolean couldn't represent "no factor enrolled under mandatory 2FA" as anything other than "not required" — a real MFA bypass under enforcement: required. Switch to decide() and branch on isRequired() / requiresSetup() / requiresChallenge().

PendingAuthManager::startSession()/startToken() require a PendingAuthPurpose argument. Pass PendingAuthPurpose::LoginChallenge or PendingAuthPurpose::MfaSetup. Pending contexts are now purpose-bound and reject use for the wrong purpose.

Token defaults changed. tokens.default_abilities was ['*'], now ['auth:read']. tokens.expiry_minutes was null (never expires), now 10080 (7 days). Set both back explicitly if you need the old behavior.

authx.throttle config keys renamed and split into independent per-account/per-IP pairs (e.g. login_per_account/login_per_ip). The old combined keys (login, two_factor, reset) are no longer read.

2fa.require_password_on_enable now defaults to true.

Re-publish config/authx.php (or diff your published copy) — an app-published config silently overrides the new safe defaults if left stale on the v2.0 shape.

No new migrations in v2.1.0.

Breaking Changes in v2.0.0

Read this section carefully before upgrading from v1.x.

Registration is disabled by default. registration.enabled now defaults to false. If you have not published authx.php, registration will be silently disabled after upgrading. Publish (or re-publish) the config and set enabled: true explicitly.

issue_token_on_register defaults to false. Token issuance on registration is now opt-in. Existing apps that relied on the true default must set this explicitly in their published config.

sendEmailOtp() no longer returns the OTP. The return type changed from string to void. The plaintext code must never escape the service layer. Any code that called sendEmailOtp() and used the return value must be updated.

ITokenAuthService interface type hint corrected. The interface previously imported Illuminate\Auth\Authenticatable (a trait). It now imports Illuminate\Contracts\Auth\Authenticatable (an interface). Custom implementations that bound to the old type hint must update their use statement.

Session is not started until 2FA passes. When 2FA is required, the session is now invalidated and the CSRF token regenerated before the challenge is issued. The session is only created after successful verification. Frontends that assumed a valid session existed during the challenge step must be updated.

SessionLoginResult::$channel is now a TwoFactorChannel enum. The field was previously a plain string. Code that compares the value using string literals must use the enum instead, e.g. TwoFactorChannel::Email.

New migration required. Run php artisan migrate after upgrading. The new migration adds last_used_counter to the two_factor_secrets table for TOTP replay protection.

Installation

Publish configuration:

Run migrations:

Authentication Flow

Authentication decisions are enforced on the backend. Frontend clients do not decide authentication state.

This prevents:

Usage

1. Login (Session Mode – SPA)

POST /auth/session/login

Response (2FA required — session not yet active):

Response (2FA not required):

2. Login (Token Mode / API Clients)

POST /auth/login

Response (no 2FA):

Response (2FA required — token is null until verified):

Response (enforcement: required and no factor enrolled yet — token is null, no OTP is sent because nothing is enrolled):

Complete setup with the pending_auth_id from this response — it carries an mfa_setup-purpose pending context, so POST /auth/2fa/totp/enable is reachable without a bearer token for this specific flow. Once TOTP is verified, a normal token is issued.

3. Get Current User

GET /auth/me — requires session cookie or Authorization: Bearer <token>

4. Logout

Session: POST /auth/session/logout

Token: POST /auth/logout

5. Forgot Password

POST /auth/password/forgot

6. Reset Password

POST /auth/password/reset

Passwords are capped at 128 characters to prevent bcrypt/argon2 resource exhaustion.

Two-Factor Authentication

Two-Factor Authentication is:

Email OTP endpoints

Authenticator App (TOTP)

Recovery Codes

Used when a TOTP user has lost access to their authenticator app:

SMS-based OTP is intentionally excluded due to SIM-swap risk. 2FA management endpoints require the current password by default.

Configuration (config/authx.php)

Frontend Integration (SPA)

Frontend clients consume backend decisions. They do not determine authentication state.

The backend returns:

Reference implementation: https://github.com/Magnificent-Big-J/lara-auth-suite-nuxt-demo

Roadmap

Version Feature
v1.0 Token + session auth, password reset
v1.1 Email OTP, TOTP, 2FA enforcement
v2.0 Security hardening, TOTP replay protection, recovery codes, Laravel 13
v2.x Trusted devices, session/token audit

Security

Report security issues privately to:

[email protected]

Do not open a public GitHub issue for security vulnerabilities.

License

MIT © Rainwaves

Credits

Built by Rainwaves Security-first authentication for serious Laravel applications.

All versions of lara-auth-suite with dependencies

PHP Build Version
Package Version
Requires php Version ^8.2|^8.3|^8.4
laravel/framework Version ^11.0|^12.0|^13.0
Composer command for our command line client (download client) This client runs in each environment. You don't need a specific PHP version etc. The first 20 API calls are free. Standard composer command

The package rainwaves/lara-auth-suite contains the following files

Loading the files please wait ...