Weave Code
Laravel Verify New Email Laravel Package
protonemedia/laravel-verify-new-email
A Laravel package for secure email changes: when users update their email, a verification link is sent to the new address and the account is only updated after confirmation, helping prevent typos, unauthorized changes, and account takeover.
Package to handle email address updates and verification
Frequently asked questions about Laravel Verify New Email
- How do I install protonemedia/laravel-verify-new-email in a Laravel app?
- Install it with Composer, publish the package config and migrations, run the migration, and add the package trait to your User model. Then expose the verification routes and customize the notification to match your app. Most integration work is in your profile-update controller, which should write a pending email instead of overwriting the active address.
- How does this package handle email changes differently from Laravel's built-in verification?
- Laravel's built-in flow verifies the current email, but it does not natively preserve the old address while a new one is confirmed. This package stores the proposed address and sends a verification link to it, leaving the account email unchanged until the link is confirmed. That reduces typos, unauthorized changes, and account takeover risk.
- Which Laravel and PHP versions are supported?
- Confirm the exact Laravel and PHP constraints in the package's composer.json and CI matrix before adopting, because the package is recently released and has limited ecosystem validation. Run a short spike on your app's current Laravel and PHP versions, including your auth guard and notification setup. Do not assume support for older Laravel releases without checking.
- Does it conflict with Laravel's MustVerifyEmail flow?
- It can overlap with Laravel's MustVerifyEmail flow, so verify how the package interacts with the verified middleware and your existing verification routes. A common approach is to keep built-in verification for initial signup and use this package only for email changes. Test both flows together before enabling it for users.
- How are verification tokens generated, expired, and invalidated?
- Review the package implementation for signed URL or token lifetime, single-use behavior, and invalidation when a new change is requested. The package should own token and notification mechanics, but your application should own rate limiting, audit logging, and abuse monitoring. Confirm that tokens cannot be replayed and that expired links fail safely.
- Can I use this package for API or SPA email change flows?
- Yes, but the package does not replace your API design: expose explicit endpoints for requesting, canceling, and confirming an email change, and return pending-email state to the frontend. For multi-tenant apps, confirm tenant scoping on pending-email lookups and verification routes. For multiple guards, verify the package resolves the correct user model.
- Is it safe for production and what security concerns should I check?
- Treat it as security-sensitive: verify signed URL lifetime, single-use tokens, rate limiting, email enumeration behavior, notification queueing, and unique constraints on pending addresses. Add audit logging and a feature flag so you can disable the flow and fall back to direct updates if delivery fails. Run a threat model and a pilot cohort before broad release.
- How do I test and handle duplicate pending emails, case changes, or concurrent updates?
- Define application rules for duplicate pending addresses, case-insensitive comparisons, and concurrent updates, because the package is narrow and your app owns edge cases. Normalize email case, enforce unique constraints, cancel prior tokens when a new request arrives, and serialize updates where needed. Test update, verify, expire, resend, duplicate, and rollback paths with acceptance tests.
- Are the verification notifications queueable and localizable?
- The package uses Laravel notifications for the verification email, so you can typically customize the notification class, queue it, and localize its content. Confirm queue support and translation publishing in the package config and README, and test with your actual queue driver. Also check branding requirements and whether the notification respects your mail templates.
- What is the maintenance and abandonment risk, and what are the alternatives?
- Code maintenance is low if version constraints stay healthy, but ecosystem validation is limited (about 412 stars and zero dependents), so assign an owner to monitor releases and be ready to fork. The package is narrow enough to replace with a custom pending-email column plus signed URLs if it is abandoned. Keep the feature behind a flag so you can roll back to direct email updates.
Weaver
How can I help you explore Laravel packages today?