- Can I use scheb/2fa-totp directly in Laravel, or is it only for Symfony?
- This package is Symfony-first, but you can integrate it into Laravel via the Symfony Bridge (e.g., `symfony/http-foundation`) or by extracting the core TOTP logic (like `spomky-labs/otp`) and wrapping it in Laravel middleware/services. The TOTP algorithm itself is framework-agnostic, so adaptation is possible with effort.
- How do I integrate TOTP verification into Laravel’s Auth::attempt() flow?
- You’ll need to create middleware (e.g., `VerifyTotpMiddleware`) that runs after `Auth::attempt()` but before session creation. Use Laravel’s middleware pipeline to sequence it correctly, and ensure it doesn’t block the initial password check—only verify TOTP afterward. Test edge cases like failed attempts or rate limiting.
- What Laravel versions does scheb/2fa-totp support?
- The package itself targets Symfony, but Laravel compatibility depends on your integration approach. If using the Symfony Bridge, aim for Laravel 8+ (due to Symfony 5+ dependencies). For a pure Laravel wrapper, target Laravel 7+ with manual adjustments. Always check the Symfony bundle’s Symfony version requirements first.
- Do I need to extend my users table or create a separate TOTP secrets table?
- You can store TOTP secrets in the `users` table (e.g., `totp_secret`, `totp_algorithm`) or a dedicated `totp_secrets` table. The package expects fields like `secret`, `digits`, and `algorithm`. Use Laravel migrations to adapt your schema, and consider encrypting secrets at rest for security.
- How do I handle QR code generation for TOTP setup in Laravel?
- The Symfony bundle uses `DomCrawler` for QR codes, but you can replace it with Laravel-native libraries like `endroid/qr-code` or generate QR codes via Blade components. Ensure the generated URI follows RFC 6238 (e.g., `otpauth://totp/...`) for compatibility with authenticator apps.
- What’s the best way to make TOTP optional for users (opt-in) in Laravel?
- Add a `has_totp_enabled` boolean to your users table and check it before requiring TOTP. Use middleware to conditionally verify TOTP only for users with the flag set. For setup, trigger a TOTP enrollment flow (e.g., via a profile page) where users scan a QR code or manually enter a secret.
- Will TOTP verification add significant latency to Laravel login requests?
- TOTP verification itself is lightweight, but network calls to validate codes (e.g., API requests to an authenticator) or database lookups for secrets could introduce minor latency. Cache secrets in Redis or the session to reduce database hits, and consider client-side validation for time-sensitive checks.
- How do I test TOTP verification in Laravel unit/integration tests?
- Mock the TOTP provider (e.g., `spomky-labs/otp`) to return fixed codes for testing. Use Laravel’s `actingAs()` or `partialMock()` to simulate authenticated users, and test edge cases like expired tokens, clock skew (time drift), and manual entry errors. Libraries like `mockery` can help isolate TOTP logic.
- What alternatives exist for TOTP in Laravel if scheb/2fa-totp is too complex?
- Consider lightweight alternatives like `spomky-labs/otp` (pure PHP, RFC 6238-compliant) or `paragonie/google-authenticator` for direct TOTP logic. For full-featured bundles, explore Laravel-specific packages like `laravel-2fa` or build a custom middleware around `spomky-labs/otp` for tighter integration.
- How do I handle failed TOTP attempts in Laravel to prevent brute force attacks?
- Implement rate limiting using Laravel’s `throttle` middleware or packages like `spatie/rate-limiter`. Track failed attempts per user/IP in the session or a `failed_totp_attempts` table, and temporarily lock accounts after thresholds (e.g., 5 attempts). Combine this with backup codes or admin overrides for recovery.