- How do I install jeremykenedy/laravel2step in a Laravel app?
- Run composer require jeremykenedy/laravel2step:^6.0; the v6 upgrade is opt-in and will not be pulled in automatically from ^5.0. Then publish the package config, views, and migration, run php artisan migrate, add the package trait to your User model, and register the two-step middleware in your HTTP kernel. The package is designed to work out of the box with Laravel's authentication scaffolding or inside your own auth flow.
- Which Laravel and PHP versions does laravel2step support?
- Version 6.0.0 is tested in CI against Laravel 12 and 13 on PHP 8.2 through 8.5, and that is the combination you should target. Composer still allows Laravel 6 through 11 and PHP 7.3, but those combinations are not exercised, so the declared support matrix overstates real support. Older Laravel releases also carry published advisories, so a clean install may refuse them anyway.
- How does laravel2step send the 4-digit verification code?
- It sends the code by email through a Laravel notification, so it uses whatever mail driver your application already has configured. You can customize the notification class to change the email copy, subject, or delivery channel. No SMS or authenticator-app support is built in; the default flow is a four-digit emailed code.
- Do I need to run a migration to use laravel2step?
- Yes. The package ships a migration that creates the two-step verification table, and you publish it into your app before running php artisan migrate. Version 6.0.0 also corrects the user relationship from hasOne to belongsTo, so confirm that your existing table uses the userId column the package now expects before assuming a no-migration upgrade.
- Why do I get a table-not-found error from laravel2step in a multi-database app?
- Earlier versions hardcoded the mysql connection; 6.0.0 falls back to your application's default connection instead. If your two-step table lives on the mysql connection but your default is something else, set LARAVEL_2STEP_DATABASE_CONNECTION=mysql explicitly. Otherwise the middleware queries the wrong database and fails at the verification step, right after login.
- How do I customize laravel2step views and config, and why are my published copies not getting updates?
- Publish the config and views with the package's vendor:publish command, then edit the copies in your resources/views and config directories. Be aware that published copies are frozen at publish time and do not receive later package fixes. If you published views before 6.0.0, you keep the old Bootstrap CDN host and jQuery 3.2.1, so re-publish or diff those assets; the CSP host change to cdnjs.cloudflare.com and the jQuery 3.7.1 update only land in the package's own views.
- Why does extending TwoStepController cause a fatal error after upgrading to 6.0.0?
- The controller's base class changed from your application's App\Http\Controllers\Controller to Illuminate\Routing\Controller. Any subclass that relied on inherited helpers such as $this->authorize() or $this->validate() will now fatal because those traits are no longer present. Add AuthorizesRequests and ValidatesRequests to your subclass, or avoid extending the package controller at all. This breakage will not surface in CI unless your tests actually hit the verification routes.
- Did laravel2step run protected controller actions before verification in older versions?
- Yes. Before 6.0.0 the middleware called $next($request) before checking whether the user had completed two-step verification, so protected controller actions ran in full and only the response was discarded. That means side effects on those routes, such as database writes, audit entries, outgoing mail, third-party API calls, or rate-limit consumption, could have happened for unverified users. Version 6.0.0 fixes the ordering, but review protected routes for state-changing side effects and treat the past behavior as a possible exposure.
- How do I test laravel2step two-step verification in Laravel feature tests?
- Use Notification::fake() and assert that the verification notification is sent after login, then hit the verification routes as an authenticated user and confirm access is granted only after a valid code. Test at least one protected route directly, because that is where middleware ordering and controller subclass breakage surface. If you extend TwoStepController, include a test that exercises it so the base-class change cannot slip through CI.
- Is laravel2step a good alternative to Laravel Fortify or Jetstream two-factor authentication?
- They solve different problems. Fortify and Jetstream provide time-based one-time passwords for authenticator apps, while laravel2step emails a four-digit code and is meant to drop into an app already using Laravel's auth scaffolding with minimal setup. Choose laravel2step if email-delivered codes and a simple middleware-plus-views flow fit your requirements; choose Fortify, Jetstream, or a Google2FA-based package if you need TOTP or recovery codes.