- How do I add two-factor authentication to Laravel with RobThree/TwoFactorAuth?
- Install the library with Composer and wrap it in a small application-owned service that exposes generateSecret, provisioningUri, and verify methods. Add nullable encrypted columns for the secret and hashed recovery codes, build enrollment and challenge controllers, and enforce the second factor in your login flow or a middleware. The library is framework-agnostic, so it provides no service provider, facade, config publishing, migrations, or middleware. Keep it behind your own interface so you can swap it for Fortify or pragmarx/google2fa later without touching call sites.
- Is robthree/twofactorauth a Laravel package or a plain PHP library?
- It is a plain, framework-agnostic PHP library implementing TOTP (RFC 6238) and HOTP (RFC 4226), not a Laravel package. There is no service provider, facade, publishable config, migration, or middleware. In Laravel it becomes one leaf dependency behind a thin wrapper you design, document, and maintain. That is a reasonable fit because 2FA verification is a small, stateless, deterministic function.
- How do I install robthree/twofactorauth with Composer?
- Run composer require robthree/twofactorauth; it is MIT licensed and has no external runtime dependencies, so installation is low friction. There is nothing to register in config/app.php and no artisan install step. After installing, create your own config file for issuer, digits, period, algorithm, and window size. Then build the wrapper service and database columns your product needs.
- Which Laravel versions does robthree/twofactorauth support?
- Because the library is framework-agnostic, it has no Laravel-specific version constraints; practical compatibility depends on your PHP version and the package's Composer requirements. Modern releases target current PHP 8 runtimes, so verify the required PHP constraint in the package's composer.json before upgrading. Any Laravel version running a supported PHP release can use it. Laravel version upgrades will not break the library, but they can affect your wrapper and controllers.
- How do I generate a QR code for Google Authenticator in Laravel?
- The library builds the otpauth provisioning URI and delegates QR rendering to a pluggable provider. Avoid the external QR image service provider for an auth flow, since it leaks secrets to a third party and adds an availability dependency; use a local provider backed by endroid/qr-code or bacon/bacon-qr-code, or render the provisioning URI client-side. Whichever you choose, keep QR generation out of the verification path and treat the provisioning URI as a secret. Also show the secret as manual-entry text for users who cannot scan.
- How should I store the two-factor secret in Laravel?
- Add a nullable two_factor_secret column with Laravel's encrypted cast and a two_factor_confirmed_at timestamp, plus hashed recovery codes stored as JSON. The library accepts a caller-supplied secret and does not handle storage, so a missing encrypted cast is a credential-leak bug. Never log the secret or the provisioning URI, and mask them in admin tooling. Provide an admin reset path that clears the secret and recovery codes.
- Does robthree/twofactorauth prevent TOTP code replay?
- Verification accepts any valid code inside the configured time window, so do not rely on the library alone to stop the same code being used twice. Implement persistent replay prevention by recording the last accepted time step or code hash per user and rejecting reuse for the window duration. Pair this with rate limiting on the challenge endpoint and an audit trail for failed attempts. A typical window is plus or minus one time step, which is a product decision you should make explicitly.
- Should I use robthree/twofactorauth or pragmarx/google2fa-laravel or Fortify?
- If your app already uses Fortify or another Laravel-native 2FA flow, adopting this library duplicates what you already have and the migration cost usually exceeds the benefit. For a greenfield build, this library plus a homegrown wrapper is defensible because it is small, MIT licensed, mature, and has no network dependency at verification time. It is strategically undifferentiated for a Laravel shop, which is why it scores low on opportunity despite being technically fine. Decide before you invest heavily in the wrapper, especially if WebAuthn or passkeys are on the roadmap.
- Does robthree/twofactorauth support HOTP, and can I configure window, digits, algorithm, and period?
- Yes, it implements both TOTP (RFC 6238) and HOTP (RFC 4226) and lets you configure the time window, code digits, hash algorithm, and period. Those settings must match what authenticator apps expect, so keep the defaults of six digits, SHA-1, and a 30-second period unless you have a strong reason to change. HOTP is counter-based, so you must persist and increment the counter server-side. Document the chosen values because they become part of your enrollment contract.
- How do I test two-factor authentication in Laravel without a real authenticator app?
- Generate a known secret in the test, compute the current code with the same library or a small helper, and freeze time with Carbon::setTestNow so the code stays deterministic. Assert that valid codes pass, expired codes and wrong digits fail, and that a reused code is rejected by your replay guard. Keep the wrapper interface narrow so tests can fake verification without the QR provider. Also test the encrypted cast and the admin reset path.