Download the PHP package theriftlab/laravel-mfa without Composer

Basic Laravel MFA

Overview

This is a bare-bones email-based 2FA package which can be configured to send out an email containing a signed link upon successful authentication. Any routes you place under the provided mfa middleware will be inaccessible until the link is clicked.

Installation

Optionally, publish the migration:

Then:

Setup

Add to User Model

First, you will need to mark your User model (or whatever model you are using for Auth) as ready for MFA:

Add to Auth Flow

Due to the non-standard nature of Laravel's auth/login flow, it is up to you to decide where/when to trigger & end the MFA session using the MfaAuth facade, which expects an authenticated user to be present in order to work.

For example, in a Breeze setup, you might add these lines into app/Http/Controllers/Auth/AuthenticatedSessionController:

Configure & Add Views

The email containing the signed link is a very simple template, and can be published:

There are also two view files which you will need to implement: resources/views/auth/mfa-sent.blade.php and resources/views/auth/mfa-invalid.blade.php.

• mfa-sent.blade.php is shown when the user is first authorized by Laravel's default auth process and is waiting for the MFA signed link email. This template can optionally contain a link / button to POST to named route mfa.resend, which will resend the signed link email. The $errors session data will contain an error message if an invalid link is clicked, and session('status') will contain a message if the link email is resent. A logout link is also a good idea on this page to restart the whole process, in case the wrong account is logged in.

• mfa-invalid.blade.php is shown when the user is not authorized and an invalid link is clicked, and therefore any resend / logout options are not available.

Note: when the user is not authorized and a valid link is clicked from an email (eg. the initial default auth session might have timed out), the user will be automatically logged in.

Configuring Your Routes

Finally, on whichever routes you wish to protect with MFA, you can add the mfa middleware after auth - for example:

This will redirect any Authed but unMFAed user back to display your auth.mfa-sent view.

Configuration

The default config is fairly self-explanatory and looks like this:

You may publish the config file if you wish to change the defaults: