Weave Code
Php Authenticator Laravel Package
chillerlan/php-authenticator
PHP 8.4+ library to generate and validate HOTP (RFC 4226) and TOTP (RFC 6238) one-time passwords—Google Authenticator compatible. Includes Steam Guard server time sync (cURL) and constant-time encoding/hex helpers (Sodium or fallback).
A generator for counter- and time based authentication codes (RFC-4226/RFC-6238, Google Authenticator).
Frequently asked questions about Php Authenticator
- Does this package work with Laravel 10+ on PHP 8.2 or 8.3? If not, what’s the workaround?
- No, the package requires PHP 8.4+. If your Laravel 10+ app uses PHP 8.2/8.3, you’ll need to either upgrade PHP or use a compatibility layer like `php84-compat` to bridge the gap. Test thoroughly after applying changes, as some PHP 8.4+ features may not be fully emulated.
- How do I store and retrieve user secrets securely in Laravel?
- Store secrets as encrypted strings in your database using Laravel’s `encrypt()` helper or a dedicated package like `spatie/laravel-encryption`. For HOTP, persist the last counter value in a `users` table or a separate `otp_counters` table. Never store secrets in plaintext or logs.
- Can I integrate this with Laravel’s authentication system (e.g., Sanctum or Passport) for 2FA?
- Yes. Use the package to generate/validate OTPs and integrate it with Laravel’s auth guards. For Sanctum/Passport, add a custom `otp` field to your login requests and validate it alongside credentials. Example: Extend `MustVerifyOtp` trait or add middleware to check OTPs before granting access.
- What happens if my server’s time is out of sync with the user’s device for TOTP?
- TOTP validation relies on server time. If your server clock drifts, codes may fail. Use `useLocalTime = false` and ensure your server syncs with NTP. For testing, mock `Carbon` or use fixed timestamps. Steam Guard’s server time sync (via cURL) can help mitigate this for TOTP.
- Is there a way to generate QR codes for TOTP setup in Laravel Blade?
- Yes. Use JavaScript libraries like `qrcode.js` or PHP libraries like `endroid/qr-code` to generate `otpauth://` URIs from the secret. Pass the URI to Blade and render it as an SVG or PNG. Example: `Authenticator::getQRCodeUrl($secret, $user->email)`.
- How do I handle failed OTP attempts in Laravel? Should I log them?
- Log failed attempts using Laravel’s logging system (`Log::warning()`) to monitor brute-force attacks. Store IP addresses, timestamps, and user IDs in the `failed_attempts` table (or a custom table) and implement rate-limiting via middleware or `throttle` directives.
- What’s the fallback if `ext-sodium` is missing? Will it break my app?
- The package falls back to `paragonie/constant_time_encoding` if `ext-sodium` is unavailable, but performance may degrade slightly. Test your app without `sodium` to ensure the fallback meets your security needs. Document this dependency in your `README` and CI checks.
- Can I customize the time window for TOTP validation (e.g., allow 2 codes before/after)?
- Yes. Use `AuthenticatorOptions` to set `timeStep` (default: 30 seconds) or adjust validation logic in your controller. For broader windows, modify the `validate()` call to check adjacent time steps manually, e.g., `Authenticator::validate($secret, $code, $timeStep * 2).
- How do I test TOTP/HOTP functionality in Laravel’s PHPUnit?
- Mock `Carbon` or use fixed timestamps in tests. For TOTP, set `Carbon::setTestNow()` to a specific time and verify codes against that timestamp. For HOTP, increment the counter manually and validate against expected values. Example: `Carbon::setTestNow(Carbon::parse('2023-01-01'));` before testing.
- Are there alternatives to this package for Laravel? Which one should I choose?
- Alternatives include `bshaffer/oauth2-server-php` (for TOTP) or `microsoft/owin-security-oauth` (legacy). For Laravel, `chillerlan/php-authenticator` is the most RFC-compliant and lightweight. Choose it if you need Steam Guard support, Sodium optimizations, or minimal dependencies. Use `egulias/email-validator` for email-based 2FA instead.
Weaver
How can I help you explore Laravel packages today?