- Can I use scheb/two-factor-bundle in a Laravel application?
- No, not natively. scheb/two-factor-bundle is a Symfony bundle that plugs into Symfony's kernel, dependency-injection container, event dispatcher, and security firewall pipeline. Laravel has no service provider, config publishing, facade, or guard integration for it, so wiring it in would mean embedding a Symfony security firewall inside Laravel, which fights both frameworks' authentication lifecycles.
- How do I install scheb/two-factor-bundle with Composer in Laravel?
- Composer may download the package, but installation does not produce a working Laravel integration. There is no Laravel auto-discovery service provider, no publishable config, and no middleware or guard hook. Making it function would require custom adapters across Symfony's Security component contracts and Laravel's Auth guards, session handling, and middleware stack.
- Which Laravel versions support scheb/two-factor-bundle?
- None. The package does not target Laravel at all and has no Laravel version compatibility matrix. Its value, including firewall-based two-factor enforcement, authentication event listeners, trusted-device cookies, and TOTP or email providers, is tightly coupled to Symfony's Security component.
- What Symfony versions does scheb/two-factor-bundle support?
- The live line is 4.x. The v4.18.4 patch restores Symfony 5.2 compatibility around the PUBLIC_ACCESS constant, but Symfony 5.2 reached end of maintenance in early 2021, so that patch targets an end-of-life runtime. The earlier supported matrix ended at Symfony 2 and 3, and the successor path is scheb/2fa-bundle or scheb/2fa on Symfony 6.x and 7.x.
- Is scheb/two-factor-bundle still maintained?
- There is evidence of some live maintenance on the 4.x line, since v4.18.4 is a shipped compatibility patch. However, a single patch does not equal a supported release cadence, a security policy, or an SLA. The package is superseded by scheb/2fa-bundle and scheb/2fa, so it should be treated as legacy rather than a long-term dependency.
- What are the best Laravel alternatives to scheb/two-factor-bundle for two-factor authentication?
- Use first-party or Laravel-native options such as laravel/fortify or pragmarx/google2fa, or a hosted identity provider like Auth0, Okta, Cognito, or WorkOS. These integrate with Laravel's guards, Authenticatable model, session handling, and middleware instead of requiring a Symfony security firewall. They also avoid the lock-in risk of an authentication dependency pinned to an end-of-life Symfony runtime.
- Does scheb/two-factor-bundle support Google Authenticator and TOTP?
- Yes. The bundle supports TOTP authenticator apps such as Google Authenticator and Authy, along with email-delivered codes and one-time backup codes. It also offers trusted-device cookies to skip repeated prompts. Those features are built for Symfony's authentication flow, not for Laravel's Auth guards.
- How do I add custom two-factor providers, backup codes, or trusted devices with this bundle?
- The bundle exposes a TwoFactorProviderInterface for custom methods, and it includes built-in backup codes and trusted-device cookies. It also provides an event-driven flow that fits existing Symfony authentication and configurable routes, templates, and firewall integration. All of those extension points are Symfony-coupled, so they would need custom adapters in a Laravel codebase.
- How should I test two-factor authentication in Laravel if I cannot use this bundle?
- Use Laravel-native tooling such as Fortify's testing helpers or pragmarx/google2fa, and write feature tests for the login challenge, TOTP verification window, single-use backup codes, and trusted-device cookies. Keep tests inside Laravel's HTTP, session, and middleware layers rather than embedding a Symfony firewall. That avoids weeks of adapter work just to reach parity with Laravel's first-party options.
- What are the production and compliance risks of using scheb/two-factor-bundle?
- The main risk is lock-in to an end-of-life Symfony runtime, since the v4.18.4 patch restores Symfony 5.2 compatibility rather than extending support for a maintained version. A minimally maintained authentication dependency can be a finding under compliance regimes such as SOC 2, PCI, or HIPAA. Transitive dependencies like OTPHP and BaconQrCode also continue to move, and a patch-level release does not visibly refresh those constraints.