|
10 | 10 | - [React](#react-customization) |
11 | 11 | - [Vue](#vue-customization) |
12 | 12 | - [Livewire](#livewire-customization) |
13 | | -- [Two-Factor Authentication](#two-factor-authentication) |
| 13 | +- [Authentication](#authentication) |
| 14 | + - [Enabling and Disabling Features](#enabling-and-disabling-features) |
| 15 | + - [Customizing User Creation and Password Reset](#customizing-actions) |
| 16 | + - [Two-Factor Authentication](#two-factor-authentication) |
| 17 | + - [Rate Limiting](#rate-limiting) |
14 | 18 | - [WorkOS AuthKit Authentication](#workos) |
15 | 19 | - [Inertia SSR](#inertia-ssr) |
16 | 20 | - [Community Maintained Starter Kits](#community-maintained-starter-kits) |
@@ -270,18 +274,106 @@ To change your authentication layout, modify the layout that is used by your app |
270 | 274 | </x-layouts.auth.split> |
271 | 275 | ``` |
272 | 276 |
|
| 277 | +<a name="authentication"></a> |
| 278 | +## Authentication |
| 279 | + |
| 280 | +All starter kits use [Laravel Fortify](/docs/{{version}}/fortify) to handle authentication. Fortify provides routes, controllers, and logic for login, registration, password reset, email verification, and more. |
| 281 | + |
| 282 | +Fortify automatically registers the following authentication routes based on the features that are enabled in your application's `config/fortify.php` configuration file: |
| 283 | + |
| 284 | +| Route | Method | Description | |
| 285 | +| ---------------------------------- | ------ | ----------------------------------- | |
| 286 | +| `/login` | `GET` | Display login form | |
| 287 | +| `/login` | `POST` | Authenticate user | |
| 288 | +| `/logout` | `POST` | Log user out | |
| 289 | +| `/register` | `GET` | Display registration form | |
| 290 | +| `/register` | `POST` | Create new user | |
| 291 | +| `/forgot-password` | `GET` | Display password reset request form | |
| 292 | +| `/forgot-password` | `POST` | Send password reset link | |
| 293 | +| `/reset-password/{token}` | `GET` | Display password reset form | |
| 294 | +| `/reset-password` | `POST` | Update password | |
| 295 | +| `/email/verify` | `GET` | Display email verification notice | |
| 296 | +| `/email/verify/{id}/{hash}` | `GET` | Verify email address | |
| 297 | +| `/email/verification-notification` | `POST` | Resend verification email | |
| 298 | +| `/user/confirm-password` | `GET` | Display password confirmation form | |
| 299 | +| `/user/confirm-password` | `POST` | Confirm password | |
| 300 | +| `/two-factor-challenge` | `GET` | Display 2FA challenge form | |
| 301 | +| `/two-factor-challenge` | `POST` | Verify 2FA code | |
| 302 | + |
| 303 | +The `php artisan route:list` Artisan command can be used to display all of the routes in your application. |
| 304 | + |
| 305 | +<a name="enabling-and-disabling-features"></a> |
| 306 | +### Enabling and Disabling Features |
| 307 | + |
| 308 | +You can control which Fortify features are enabled in your application's `config/fortify.php` configuration file: |
| 309 | + |
| 310 | +```php |
| 311 | +use Laravel\Fortify\Features; |
| 312 | + |
| 313 | +'features' => [ |
| 314 | + Features::registration(), |
| 315 | + Features::resetPasswords(), |
| 316 | + Features::emailVerification(), |
| 317 | + Features::twoFactorAuthentication([ |
| 318 | + 'confirm' => true, |
| 319 | + 'confirmPassword' => true, |
| 320 | + ]), |
| 321 | +], |
| 322 | +``` |
| 323 | + |
| 324 | +If you want to disable a feature, simply comment out or remove that feature entry from the `features` array. For example, remove `Features::registration()` to disable public registration. |
| 325 | + |
| 326 | +<a name="customizing-actions"></a> |
| 327 | +### Customizing User Creation and Password Reset |
| 328 | + |
| 329 | +When a user registers or resets their password, Fortify invokes action classes located in your application's `app/Actions/Fortify` directory: |
| 330 | + |
| 331 | +| File | Description | |
| 332 | +| ----------------------------- | ------------------------------------- | |
| 333 | +| `CreateNewUser.php` | Validates and creates new users | |
| 334 | +| `ResetUserPassword.php` | Validates and updates user passwords | |
| 335 | +| `PasswordValidationRules.php` | Defines password validation rules | |
| 336 | + |
| 337 | +For example, to customize your application's registration logic, you should edit the `CreateNewUser` action: |
| 338 | + |
| 339 | +```php |
| 340 | +public function create(array $input): User |
| 341 | +{ |
| 342 | + Validator::make($input, [ |
| 343 | + 'name' => ['required', 'string', 'max:255'], |
| 344 | + 'email' => ['required', 'email', 'max:255', 'unique:users'], |
| 345 | + 'phone' => ['required', 'string', 'max:20'], // [tl! add] |
| 346 | + 'password' => $this->passwordRules(), |
| 347 | + ])->validate(); |
| 348 | + |
| 349 | + return User::create([ |
| 350 | + 'name' => $input['name'], |
| 351 | + 'email' => $input['email'], |
| 352 | + 'phone' => $input['phone'], // [tl! add] |
| 353 | + 'password' => Hash::make($input['password']), |
| 354 | + ]); |
| 355 | +} |
| 356 | +``` |
| 357 | + |
273 | 358 | <a name="two-factor-authentication"></a> |
274 | | -## Two-Factor Authentication |
| 359 | +### Two-Factor Authentication |
| 360 | + |
| 361 | +Starter kits include built-in two-factor authentication (2FA), allowing users to secure their accounts using any TOTP-compatible authenticator app. 2FA is enabled by default via `Features::twoFactorAuthentication()` in your application's `config/fortify.php` configuration file. |
275 | 362 |
|
276 | | -All starter kits include built-in two-factor authentication (2FA) powered by [Laravel Fortify](/docs/{{version}}/fortify#two-factor-authentication), adding an extra layer of security to user accounts. Users can protect their accounts using any Time-based One-Time Password (TOTP) supporting authenticator application. |
| 363 | +The `confirm` option requires users to verify a code before 2FA is fully enabled, while `confirmPassword` requires password confirmation before enabling or disabling 2FA. For more details, see [Fortify's two-factor authentication documentation](/docs/{{version}}/fortify#two-factor-authentication). |
277 | 364 |
|
278 | | -Two-factor authentication is enabled by default and supports all options provided by [Fortify](/docs/{{version}}/fortify#two-factor-authentication): |
| 365 | +<a name="rate-limiting"></a> |
| 366 | +### Rate Limiting |
| 367 | + |
| 368 | +Rate limiting prevents brute-forcing and repeated login attempts from overwhelming your authentication endpoints. You can customize Fortify's rate limiting behavior in your application's `FortifyServiceProvider`: |
279 | 369 |
|
280 | 370 | ```php |
281 | | -Features::twoFactorAuthentication([ |
282 | | - 'confirm' => true, |
283 | | - 'confirmPassword' => true, |
284 | | -]); |
| 371 | +use Illuminate\Support\Facades\RateLimiter; |
| 372 | +use Illuminate\Cache\RateLimiting\Limit; |
| 373 | + |
| 374 | +RateLimiter::for('login', function ($request) { |
| 375 | + return Limit::perMinute(5)->by($request->email.$request->ip()); |
| 376 | +}); |
285 | 377 | ``` |
286 | 378 |
|
287 | 379 | <a name="workos"></a> |
|
0 commit comments