Weave Code
Auth Laravel Package
componist/auth
Livewire-basiertes Auth-Package für Laravel mit fertigen UI-Komponenten für Login, Registrierung, Passwort-Reset und E-Mail-Verifizierung sowie optionaler E-Mail-2FA. Inklusive Rate-Limiting, Session-Härtung, Feature-Flags und konfigurierbarer Defaults.
Livewire-based authentication for Laravel. Ready-made UI for login, registration, password reset, email verification, and email-based 2FA, with rate limiting, session hardening, and feature flags.
Frequently asked questions about Auth
- Does Componist Auth work with Laravel 10+ and Livewire 3?
- Yes, Componist Auth is designed for Laravel 9+ and 10+, with full compatibility for Livewire 3. The package leverages Livewire’s reactive components, so ensure your Livewire version matches Laravel’s supported ecosystem. Always check the package’s `composer.json` for exact version constraints.
- Can I use Componist Auth without Livewire? What are the alternatives?
- No, Componist Auth is tightly coupled to Livewire for its UI components. If you don’t use Livewire, you’d need to replace the Livewire views with Blade, Inertia.js, or Alpine.js components, which may require significant refactoring. Alternatives like Laravel Breeze or Jetstream offer Livewire-free auth solutions.
- How do I customize the UI to match my Tailwind/Bootstrap design system?
- Componist Auth’s Livewire components are self-contained but can be styled via Tailwind or Bootstrap by overriding their CSS classes or extending the provided Blade layouts. The `layouts-app` config setting lets you define a custom wrapper view. Review the package’s published assets for styling hooks or extend the Livewire components directly.
- What happens if I already have custom fields in the `users` table?
- The package adds `two_factor_code`, `two_factor_expires_at`, and `last_login` to the `users` table via migrations. If your table is already customized, you’ll need to merge these fields into your existing migration or manually add them. Always back up your database before running migrations.
- How do I disable email verification or 2FA in production?
- Use the `.env` flags: set `COMPONIST_AUTH_VERIFICATION=false` to skip email verification or `COMPONIST_AUTH_TWO_FACTOR=false` to disable 2FA. These flags are feature-toggled at runtime, so no code changes are needed. For production, ensure these settings align with your security policies.
- Does Componist Auth support social logins (Google, GitHub) or OAuth?
- No, Componist Auth focuses solely on email/password authentication with optional 2FA. For social logins, integrate Laravel’s built-in OAuth packages (e.g., Laravel Socialite) alongside this package. The auth flows remain separate but can be combined via middleware or custom guards.
- How do I test the rate-limiting and session hardening features?
- Test rate-limiting by simulating rapid login attempts (e.g., with Laravel’s `Http::fake()` or Pest/PHPUnit). For session hardening, verify that `same-site` cookies, CSRF protection, and session expiration align with your `config/componist_auth.php` settings. Use Laravel’s `session()` helper to inspect session data during tests.
- What’s the rollback plan if Componist Auth breaks authentication in production?
- Maintain a backup of your original auth logic (e.g., Laravel Breeze/Jetstream) and ensure you can revert to it quickly. Document the steps to disable Componist Auth’s middleware (`Authenticate`) and restore your previous auth provider. Test the rollback in staging before production deployment.
- Can I use Componist Auth alongside Laravel Sanctum or Passport for APIs?
- Yes, Componist Auth handles web authentication (sessions, Livewire), while Sanctum/Passport manage API tokens. Configure Sanctum/Passport separately and use middleware like `auth:sanctum` or `auth:api` for API routes. The packages don’t conflict but serve distinct purposes.
- Are there any known security risks with the 2FA implementation?
- The package uses email-based 2FA with time-limited tokens, but ensure your SMTP setup is secure (TLS, strong credentials). Test edge cases like token expiration during network issues or concurrent login attempts. For high-security apps, consider hardware keys or TOTP (Time-based OTP) via packages like `laravel-two-factor-auth`.
Weaver
How can I help you explore Laravel packages today?