Weave Code
Laravel Password Rotation Laravel Package
bbs-lab/laravel-password-rotation
A Laravel package that enforces password rotation policies by tracking password age and prompting users to update credentials on schedule, with configurable intervals and middleware support.
Force any Laravel authenticatable to rotate its password every N days — with reuse prevention, a first-login gate, expiry warnings and a redirect middleware. No admin panel required.
Frequently asked questions about Laravel Password Rotation
- How do I install bbs-lab/laravel-password-rotation in a Laravel app?
- Install it with Composer using composer require bbs-lab/laravel-password-rotation. Laravel package auto-discovery should register the service provider, and you should publish the package configuration so you can set rotation intervals and middleware options. Check the README for any additional publish or migration commands before enabling enforcement in an existing application.
- How does password expiry work in this Laravel package?
- The package tracks the age of each authenticatable model's password and compares it against a configurable number of days. Once a password is older than the configured interval, the user is treated as expired and is prompted or redirected to update their credentials. Because it works with Laravel authenticatables, it can apply to any model implementing the Authenticatable contract, not only the default User model.
- Does this package prevent users from reusing an old password?
- Yes, the package includes password reuse prevention so users cannot simply set an expired password back to a previous value. New passwords are checked against previously used passwords tracked by the package before the change is accepted. This closes the most common loophole in rotation policies.
- What is the first-login gate and when should I use it?
- The first-login gate forces users to set a new password the first time they sign in, before they can reach the rest of the application. It is useful for provisioned accounts, invited users, or any account that starts with a temporary credential. It works alongside the normal expiry checks and redirect middleware.
- How do I configure the password rotation interval?
- Rotation intervals are configured in the package config file, typically as a number of days. You can set a global default and, if the package exposes model-level overrides, adjust the policy for specific authenticatable types or users. Keep intervals aligned with your security policy, since very short intervals increase support burden and user friction.
- Which Laravel and PHP versions are supported?
- The package is built for Laravel applications and integrates through standard service provider and middleware hooks. Exact Laravel and PHP version constraints are declared in the package's composer.json, so check those before installing into an older or brand-new Laravel release. Running composer require will immediately tell you if your framework version is incompatible.
- How do I redirect users to change an expired password with middleware?
- Add the package's redirect middleware to your web or auth middleware group so expired users are intercepted on their next request. The middleware detects password expiry and redirects to your password change route while allowing the routes needed to complete the update. The redirect target and exclusions are typically adjustable through configuration.
- Can users be warned before their password expires?
- Yes, the package supports expiry warnings so users can be notified before their password actually expires. Warnings can be surfaced in your UI or through notifications depending on how you integrate the package. This reduces the number of users who are suddenly locked out of the change-password flow.
- How should I test password rotation in my Laravel application?
- Use Laravel's time-travel test helpers to simulate users whose passwords are older than the configured interval, then assert that the middleware redirects them to the change-password flow. Factories can create users and set the password-updated timestamp to represent expired and non-expired states. Feature tests around the middleware are the most reliable way to confirm your protected routes behave correctly.
- Is this package suitable for production and how is it maintained?
- Before using it in production, review the repository's release history, open issues, and test coverage, because the package participates directly in authentication flows. Pin a known-good version in composer.json and cover the rotation middleware with your own feature tests. If maintenance slows down, keep a fork or an internal fallback plan ready.
Weaver
How can I help you explore Laravel packages today?