Fortify Laravel Package

Technical Evaluation

Architecture Fit

Laravel Fortify is a highly modular, backend-agnostic authentication solution designed for Laravel applications. It excels in:

• Decoupled architecture: Frontend-agnostic (works with SPAs, traditional Blade views, or mobile apps via API).
• Laravel-first integration: Leverages Laravel’s built-in features (e.g., Eloquent, Sanctum, sessions) while providing customizable middleware, policies, and events.
• Feature completeness: Covers core auth flows (registration, login, password resets, email verification, 2FA) with extensibility for custom logic (e.g., skills, passwordless auth via Features trait).
• Security-first: Includes rate limiting, CSRF protection, and compliance with Laravel’s security best practices (e.g., password hashing, session management).

Key architectural strengths:

• Event-driven: Emits events for critical actions (e.g., TwoFactorAuthenticationEnabled, RecoveryCodeReplaced), enabling observability and custom logic.
• Middleware flexibility: Allows overriding default auth middleware (e.g., RedirectIfTwoFactorAuthenticatable).
• Octane compatibility: Supports Laravel’s high-performance server (via scoped bindings in v1.35.0+).

Potential misfits:

• Monolithic Laravel dependency: Requires Laravel’s ecosystem (e.g., Eloquent, Sanctum for SPAs). Not suitable for non-Laravel PHP projects.
• Opinionated defaults: Assumes standard Laravel user model/table structure (though customizable via User model binding).

Integration Feasibility

Critical dependencies:

• Sanctum (for SPA/API auth): Required if using frontend frameworks. Can be swapped for Passport if OAuth2 is needed.
• Mail drivers: For email verification/resets (e.g., SMTP, Mailgun).
• Session driver: For traditional auth (e.g., file, database, redis).

Technical Risk

Highest-risk items:

1. 2FA setup: Requires google2fa package and proper database columns (two_factor_secret, two_factor_recovery_codes).
2. Custom auth flows: Extending Fortify (e.g., adding magic links) may require deep controller/policy overrides.

Key Questions for TPM

1. Frontend Requirements:

   • Is the frontend a SPA (React/Vue), traditional Blade app, or mobile? This dictates Sanctum/Passport choice.
   • Are there custom auth UI requirements (e.g., branded login pages) that conflict with Fortify’s defaults?

2. User Model:

   • Does the user model extend Authenticatable and optionally TwoFactorAuthenticatable? If not, what’s the custom logic?
   • Are there non-standard auth fields (e.g., username instead of email)? Fortify’s retrieveByCredentials() may need adjustment.

3. Security:

   • Are there compliance requirements (e.g., GDPR, SOC2) that necessitate custom event listeners or audit logging?
   • Should passwordless auth (e.g., magic links) be supported? Fortify lacks this natively (would require custom Features implementation).

4. Scalability:

   • Will the app use Octane? If so, test scoped bindings early (v1.35.0+).
   • Is the session driver (e.g., Redis) scalable for expected user load?

5. Migration Path:

   • Is the existing auth system (e.g., custom controllers) minimal? Fortify replaces most of it, so a big-bang migration may be needed.
   • Are there legacy auth tokens (e.g., from Laravel Passport) that need co-existence?

6. Monitoring:

   • Should Fortify events (e.g., TwoFactorAuthenticationFailed) trigger alerts or analytics?
   • Are there custom metrics needed (e.g., 2FA success rates)?

7. Customization:

   • Are there plans to extend Fortify (e.g., adding "skills" or custom policies)? This impacts long-term maintenance.
   • Should the default middleware (e.g., auth, verified) be renamed or customized?

Integration Approach

Stack Fit

Fortify is optimized for the following Laravel stacks:

Database Schema Requirements:

// Core columns (required)
Schema::table('users', function (Blueprint $table) {
    $table->string('email')->unique();
    $table->timestamp('email_verified_at')->nullable();
    $table->string('password');
    $table->rememberToken();
    $table->timestamps();
});

// 2FA columns (required for 2FA)
$table->string('two_factor_secret')->nullable();
$table->string('two_factor_recovery_codes')->nullable();
$table->timestamp('two_factor_confirmed_at')->nullable();

Migration Path

Option 1: Big-Bang Migration (Recommended for Greenfield Projects)

1. Prerequisites:

   • Laravel 10+ (target v13 for latest features).
   • PHP 8.1+ (8.5 for full compatibility).
   • Configure SESSION_DRIVER (e.g., redis) and mail services.

2. Steps:

   • Install Fortify:

     composer require laravel/fortify
     php artisan vendor:publish --provider="Laravel\Fortify\FortifyServiceProvider"
     

   • Publish and configure:

     php artisan fortify:install
     

   • Update User model to implement Authenticatable (and TwoFactorAuthenticatable if using 2FA).
   • Run migrations:

     php artisan migrate
     

   • Configure frontend