Weave Code
Fortify Laravel Package
laravel/fortify
Laravel Fortify is a frontend-agnostic authentication backend for Laravel. It provides registration, login, password reset, email verification, and two-factor authentication endpoints and features used by Laravel starter kits, while letting you build your own UI.
Backend controllers and scaffolding for Laravel authentication.
Frequently asked questions about Fortify
- How do I install Laravel Fortify in an existing Laravel project?
- Run `composer require laravel/fortify` and then execute `php artisan fortify:install`. This publishes migrations, controllers, and config files. For Sanctum (SPA support), install it separately with `composer require laravel/sanctum` and run its migrations.
- Does Fortify work with Laravel Sanctum for SPAs like React or Vue?
- Yes, Fortify is fully compatible with Sanctum. It provides API endpoints for token-based authentication, and you’ll need to configure Sanctum’s middleware (e.g., `VerifyCsrfToken` exceptions) to handle SPA routes. The `fortify:install` command sets up Sanctum routes by default.
- What Laravel and PHP versions does Fortify support?
- Fortify supports Laravel 10.x–13.x and PHP 8.1–8.5 (as of v1.37.0). Check the [official docs](https://laravel.com/docs/fortify) for version-specific requirements, as older versions may drop support for PHP 8.1. Always test upgrades in a staging environment.
- Can I customize user creation logic in Fortify?
- Absolutely. Fortify allows you to override user creation via the `CreateNewUser` trait or by binding your own implementation to the `Fortify::createUserUsing()` method. This is useful for adding custom fields (e.g., `role`) or validation rules during registration.
- How does Fortify handle two-factor authentication (2FA)?
- Fortify supports TOTP (Time-based One-Time Password) and passkeys. It stores 2FA secrets in the `two_factor_secrets` table and recovery codes in `recovery_codes`. You can enable 2FA via middleware (`EnsureTwoFactorEnabled`) or manually trigger flows using `Fortify::attemptTwoFactorAuthentication()`.
- Is Fortify secure for production? What protections does it include?
- Yes, Fortify includes built-in security measures like rate limiting, password rotation, and CSRF protection. It also enforces secure password policies (configurable via `Password::minLength()`) and supports session invalidation during password changes. Always enable HTTPS and audit middleware like `VerifyCsrfToken`.
- How do I integrate Fortify with a custom frontend (non-SPA, non-Blade)?
- Fortify is frontend-agnostic, so you can use its API endpoints with any frontend (e.g., mobile apps). Configure CORS for cross-origin requests and ensure your frontend handles redirects (e.g., after login) via API responses. For mobile, use API tokens or Sanctum’s token-based auth.
- Can I use Fortify alongside Laravel’s built-in Auth system?
- No, Fortify replaces Laravel’s default auth controllers and migrations. It’s designed to work as a standalone solution. If you need hybrid auth (e.g., OAuth + Fortify), you’ll need to manually merge logic or use middleware to route requests appropriately.
- How do I test Fortify in my Laravel application?
- Use Laravel’s testing tools to mock Fortify’s HTTP requests. For example, test login with `post('/login', ['email' => 'user@example.com', 'password' => 'password'])` and assert responses. Fortify emits events (e.g., `AttemptingToAuthenticate`) that you can test via `Events::assertDispatched()`.
- What are the alternatives to Laravel Fortify, and when should I choose them?
- Alternatives include Laravel Breeze (includes UI) or Jetstream (feature-rich with teams/invites). Choose Fortify if you need a lightweight, UI-free backend. Use Breeze/Jetstream if you want pre-built Blade/Vue/React views. For legacy apps, consider rolling your own auth with Laravel’s auth contracts.
Weaver
How can I help you explore Laravel packages today?