Fortify Laravel Package

Technical Evaluation

Architecture Fit

Laravel Fortify is a highly specialized, opinionated authentication backend designed for Laravel applications. It excels in:

• Frontend-agnostic architecture: Works seamlessly with SPAs (via Sanctum), traditional Blade views, or custom frontend stacks (e.g., React, Vue).
• Modularity: Provides pre-built controllers, policies, and middleware for core auth flows (login, registration, password resets, 2FA, passkeys), reducing boilerplate.
• Laravel ecosystem integration: Leverages Laravel’s authentication contracts, events, and policies, ensuring consistency with Laravel’s security patterns.
• Extensibility: Supports custom guards, user models, and validation rules via configuration or overrides.

Key Fit Criteria: ✅ Ideal for: Greenfield Laravel projects, SPAs needing backend auth, or teams prioritizing security and rapid development. ❌ Less ideal for: Legacy systems with deeply custom auth logic or non-Laravel stacks.

Integration Feasibility

Fortify’s integration hinges on three pillars:

1. Laravel Compatibility:

   • Requires Laravel 11+ (as of v1.37.x) and PHP 8.2+ (PHP 8.1 dropped in v1.37.0).
   • No database migrations: Uses Laravel’s built-in users table (or custom models) with minimal schema requirements (e.g., two_factor_secret for 2FA).
   • Route/Controller Overrides: Fortify registers routes via Laravel’s service provider, but conflicts can arise with existing auth routes (e.g., LoginController).

2. Frontend Agnosticism:

   • SPA Support: Requires Sanctum for token-based auth (Fortify includes Sanctum scaffolding).
   • Traditional Views: Includes Blade views but can be disabled in favor of custom frontend logic.
   • API-First: Designed for JSON responses (e.g., POST /login returns a token), but can be adapted for hybrid setups.

3. Security Features:

   • 2FA: Uses TOTP (Time-based OTP) with Laravel’s pragmarx/google2fa package.
   • Passkeys: Added in v1.37.0 (WebAuthn support).
   • Passwordless Auth: Optional via email/magic links.
   • Rate Limiting: Built-in throttling for brute-force protection.

Feasibility Risks:

• Middleware Conflicts: Fortify’s VerifyCsrfToken and EnsureEmailIsVerified middleware may clash with existing middleware.
• Custom User Models: Requires extending Fortify’s User contract or configuring custom providers.
• Session Handling: SPAs must manage session regeneration (Fortify handles this for Blade apps).

Technical Risk

Critical Questions for TPM:

1. Frontend Stack: Is the app an SPA, traditional Blade app, or hybrid? This dictates Sanctum vs. session-based auth.
2. Custom Auth Logic: Are there existing auth controllers/policies that conflict with Fortify’s defaults?
3. 2FA/Passkey Requirements: Does the project need TOTP, passkeys, or both? This affects database schema and frontend support.
4. Legacy Compatibility: Is the app using Laravel <11 or PHP <8.2? If so, Fortify may require a major upgrade.
5. Third-Party Auth: Will Fortify integrate with OAuth (e.g., Google, GitHub)? Fortify is auth-agnostic but doesn’t include OAuth providers.

Integration Approach

Stack Fit

Fortify is optimized for the following Laravel stacks:

• Backend: Laravel 11+ with PHP 8.2+.
• Frontend:
  • SPAs: React/Vue/Angular with Sanctum for token-based auth.
  • Traditional: Blade templates with session-based auth.
  • APIs: JSON endpoints for mobile/web apps.
• Database: MySQL/PostgreSQL/SQLite (Fortify uses Eloquent; no ORM-specific constraints).
• Security: Sanctum for API tokens, Laravel’s built-in encryption for passwords.

Non-Fit Scenarios:

• Non-Laravel backends (e.g., Node.js, Django).
• Apps requiring custom auth protocols (e.g., OAuth2 server, SAML).
• Projects with pre-existing auth systems (e.g., Casbin, custom RBAC).

Migration Path

Rollback Plan:

• Fortify’s routes/controllers can be disabled by removing the service provider from config/app.php.
• Backup existing auth logic before integration to revert if conflicts arise.

Compatibility

Key Compatibility Checks:

• Run composer why-not laravel/fortify to detect version conflicts.
• Test with php artisan fortify:check (if available) or manually verify route/middleware conflicts.

Sequencing

Recommended integration sequence for minimal disruption:

1. Isolate Auth: Temporarily disable existing auth routes/controllers.
2. Install Fortify: Add to composer.json and publish assets.
3. Configure Guard: Set guard in fortify.php to match your user model.
4. Frontend First: Implement login/registration in the frontend before testing other flows.
5. Incremental Testing:
   • Test registration/login → password resets → 2FA → passkeys (if enabled).
6. Middleware Audit: Ensure `VerifyCsrf