Páginas · Laravilt
Two-Factor Authentication
Authenticator app (TOTP) and email code second factors with recovery codes.
Two-factor authentication (2FA) adds a second step after login. Users turn it on from their settings, choosing an authenticator app (TOTP) or email codes.
Enable in the panel
Calling ->twoFactor() with no builder registers both TotpDriver and EmailDriver. The signature is twoFactor(?string $page = null, ?string $path = null, ?callable $builder = null), so pass the builder as a named argument.
Drivers
| Driver | Name | How it works |
|---|---|---|
Laravilt\Auth\Drivers\TotpDriver | totp | Shows a QR code for Google Authenticator, 1Password, Authy and similar apps. Requires confirmation with a first code. |
Laravilt\Auth\Drivers\EmailDriver | email | Emails a one-time code at each login. |
Custom drivers
Implement Laravilt\Auth\Contracts\TwoFactorDriver (getName(), getLabel(), getIcon(), enable(), verify(), send(), requiresSending(), requiresConfirmation()) and register it:
provider() accepts a class name (resolved from the container) or an instance.
User flow
- The user opens Settings > Two-Factor (
/admin/settings/two-factor), picks a method and confirms it. - Recovery codes are generated when 2FA is confirmed. They can be regenerated from the same page.
- At the next login, the user is redirected to
/admin/two-factor/challenge. A lost device can be bypassed at/admin/two-factor/recoverywith a recovery code.
Secrets and recovery codes are stored on the users table (two_factor_secret, two_factor_recovery_codes, two_factor_confirmed_at, two_factor_method, two_factor_enabled). The LaraviltUser trait includes Fortify's TwoFactorAuthenticatable, so Fortify helpers such as $user->recoveryCodes() are available. Use $user->hasTwoFactorEnabled() to check the status.
Events
TwoFactorEnabled, TwoFactorDisabled, TwoFactorChallengeSuccessful and TwoFactorChallengeFailed. See Events.