- How do I install mpociot/laravel-face-auth in a Laravel app?
- You install it with Composer, publish the package config and migration, then run the migration that creates the table storing a user's reference image. The package registers a service provider and exposes configurable routes and views for enrollment and webcam login. However, its Composer constraints date from March 2017, so a modern Laravel install will usually require dependency overrides or a vendored fork.
- Which Laravel and PHP versions does laravel-face-auth support?
- The last release was March 2017, so its constraints target Laravel 5.x-era applications and PHP versions that predate current LTS lines. Composer will not resolve it against Laravel 9, 10, or 11 without overrides. Plan on forking and updating the service provider, config, and dependency constraints if you need it on a supported framework.
- Does laravel-face-auth still work with the Microsoft Face API?
- No. The package delegates recognition to the Microsoft Face API, which has been restricted and progressively retired for public identification and verification use. That is a hard blocker rather than a configuration issue. The practical path is to remove the Microsoft client and implement a supported provider or a self-hosted model behind a swappable adapter.
- How does face authentication plug into Laravel's existing auth guards and middleware?
- It is a thin integration layer: a service provider, publishable config, a migration for the per-user reference image, and a guard or middleware hook. The flow is enroll, capture via webcam, match the submitted image, then hand a pass or fail to Laravel's normal auth flow. Protected routes and user identification continue to work through familiar guards and middleware.
- How do I tune the face matching threshold in laravel-face-auth?
- The match threshold is configurable, but the package gives no guidance on the false-accept versus false-reject tradeoff. That decision is security-sensitive: a loose threshold makes a printed photo or screen replay more likely to pass, while a tight one increases failed logins. Define your required assurance level first, then set and test the threshold against real capture conditions.
- Is it safe to store users' face images with laravel-face-auth?
- The package stores a per-user reference image, which creates a sensitive biometric dataset subject to GDPR special-category obligations, BIPA-style consent and retention rules, and similar regimes. It provides no encryption at rest, no erasure workflow beyond the user record, and no liveness or anti-spoofing checks. Treat encrypted storage, consent capture, retention jobs, audit logging, and a DPIA as mandatory net-new scope before production use.
- Can I use laravel-face-auth in production?
- Not as an installed dependency. It is best treated as an executable reference architecture or a one-to-three day spike, because its core provider is retired, its framework constraints are stale, and it has no recorded dependents exercising it on modern stacks. Production use means vendoring a fork into an internal namespace, swapping the recognition provider, and building out biometric data handling.
- How do I test face authentication in a Laravel application?
- Because the recognition call sits behind the package's integration hook, the cleanest approach is to extract a FaceMatcher contract and fake the adapter in tests so you can assert pass and fail paths without a real provider. Test enrollment, the guard hand-off, middleware protection, and threshold edge cases with representative image payloads. Do not rely on the original package for test coverage; it has no downstream community validating it against current Laravel versions.
- What frontend does laravel-face-auth need for webcam face capture?
- The capture side is front-end agnostic: the package expects an image payload, so a React or Vue webcam component, a Blade page, or a mobile web view can drive it unchanged. The original stack references face-api.js for browser-side capture. You will still need to handle camera permissions, image quality, and liveness checks in your own UI.
- Is laravel-face-auth maintained, and what should I use instead?
- No. The last release was March 2017 and the Microsoft Face API dependency has been retired, so there is no upstream path. For new work, evaluate Azure AI Vision Face, AWS Rekognition, or a self-hosted ONNX or InsightFace model, wrapped in an internal FaceMatcher contract so the provider stays swappable. If you keep the package at all, fork and modernize it rather than installing from Packagist.