Download the PHP package sicaboy/laravel-security without Composer
On this page you can find all versions of the php package sicaboy/laravel-security. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.
Download sicaboy/laravel-security
More information about sicaboy/laravel-security
Files in sicaboy/laravel-security
Package laravel-security
Short Description This package can be used to enhance the user security of Laravel projects.
License MIT
Homepage https://github.com/sicaboy/laravel-security
Informations about the package laravel-security
Laravel Security Components
Introduction
This package can be used to enhance the user security of Laravel projects.
Installation
Requirements:
To get the latest version of Laravel Security, simply run:
Then do vendor publish:
After publishing, you can modify templates and config in:
If you're on Laravel < 5.5, you'll need to register the service provider. Open up config/app.php
and add the following to the providers
array:
Features
Disallow user to use a common password or a used password
Verify the user-provided password is not one of the top 10,000 worst passwords as analyzed by a respectable IT security analyst. Read about all here, here(wired) or here(telegram)
Available validators rules
-
NotCommonPassword - Avoid user to use a common used password
- NotAUsedPassword - Avoid user to use a password which has been used before
CAUTION: Extra event you need to call
User login and register events have been automatically traced. While there is an extra event you should add to call explicitly.
Usage
Password Policies
- Delete accounts with days of no activity
- Lockout accounts with days of no activity
- Force change password every x days
-
To enable the first two policies, you need to set
enabled
totrue
inconfig/laravel-security.php
as below: - To reject locked accounts and force user to change their password every x days, you will need to use this middleware
If Using Different User Objects
-
If you use different
User
objects, for example a traditionalApp\User
and a customize admin user, you can write middleware this way: - Add config group in your
config/laravel-security.php
-
To enable
Force change password every x days
you need to setenabled
totrue
andchange_password_url
inconfig/laravel-security.php
as below: -
Add the following commands to
app/Console/Kernel.php
of your application. Implement to one instance if using web server clusters - Make sure you add the Laravel scheduler in your crontab Implement to one instance if using web server clusters
Multi-factor Authentication
This feature has been moved to sicaboy/laravel-mfa
TODO
-
Ability to split
extended_security
table to multiple tables. or other methods to support websites with huge user mount. - Add cron job to remove too old password records to avoid heavy table.
Changelog
Please see CHANGELOG for more information on what has changed recently.
Contributing
Please feel free to fork this package and contribute by submitting a pull request to enhance the functionalities.
License
The MIT License (MIT). Please see License File for more information.