- What does josiasmontag/laravel-email-verification do?
- It is a Laravel package that handles user email verification by sending an activation mail. It adds signed verification links, token-based confirmation, configurable expiration, verification routes, middleware, and notifications so new users confirm their email before accessing protected areas of your app.
- How do I install laravel-email-verification?
- Install it with Composer via composer require josiasmontag/laravel-email-verification. Because it is a Laravel package, its service provider is auto-discovered on Laravel 5.5 and later, so manual provider registration is normally unnecessary. Check the repository README for any publishable config, migrations, or route registration steps before wiring it into your app.
- Which Laravel versions are supported by laravel-email-verification?
- The only compatibility signal noted in the release is Laravel 5.6, so treat 5.6 as the validated target rather than assuming support for newer versions. Before adopting, inspect composer.json for illuminate/support and php constraints, then run a throwaway composer update against your actual target Laravel version. If you are on Laravel 10, 11, or 12, expect constraint conflicts or runtime issues until proven otherwise.
- How does the email verification flow work in this package?
- New users receive an activation email containing a signed link or token that confirms ownership of the address. The package registers verification routes and middleware so unverified users are blocked from protected areas until they confirm. Expiration is configurable, and after successful confirmation the user is marked verified in your application.
- Can I configure the verification link expiration time?
- Yes, expiration is configurable as part of the package's token and signed-link handling. You will typically set the lifetime in a published config file or environment variable and let the package invalidate stale links. Confirm the exact key and default in the README or source before relying on it in production.
- How do I customize the verification email notification?
- The package uses notifications to send the activation mail, so you can customize the email by overriding the notification class or publishing its views. Check whether the package exposes a config option for the notification class or mail template. If not, extend the provided notification and point the package at your subclass.
- How do I test email verification with this package in Laravel?
- Use Laravel's notification and mail fakes to assert that the activation notification is sent after registration without actually delivering mail. Then simulate the signed link or token request to confirm the user becomes verified, and test that protected routes reject unverified users. Also cover expired-token behavior and resend flows.
- Is laravel-email-verification safe to use in production?
- The package handles a security-sensitive surface, email ownership verification, so review its token generation, signing, and expiration logic before production use. The larger risk flagged in the assessment is platform age: a Laravel 5.6 target implies EOL PHP and framework versions, which inherit unpatched security exposure. Run a resolution and runtime smoke test on your actual stack, and proceed only if the constraints and code path check out.
- What are alternatives to laravel-email-verification?
- Laravel 5.7 and later ship built-in email verification via MustVerifyEmail, the verified middleware, and verification notifications, which covers most of this package's use case on modern Laravel. For older Laravel 5.5 or 5.6 apps, you can use this package or vendor a small in-house verification flow. If the package is unmaintained on your target version, framework-native or in-house is usually the safer path.
- Is josiasmontag/laravel-email-verification still maintained?
- The assessment flags a weak maintainer signal: the only recent note is a patch release adding Laravel 5.6 compatibility, with no changelog, commit cadence, or security policy data. Before adopting, check the repository for last commit date, open issues, and tagged release history. If activity is stale, plan to vendor the behavior or migrate to Laravel's built-in email verification.