- What Laravel and PHP versions does soved/laravel-magic-auth support?
- The package's last release was in September 2020, so it targets the Laravel 6, 7, and 8 era and corresponding PHP versions. There is no validated support for Laravel 9, 10, 11, or 12. Check the composer.json constraints and test against your exact Laravel and PHP versions before committing, because stale packages often rely on deprecated framework APIs.
- How do I install soved/laravel-magic-auth?
- Installation is typically done with Composer, followed by publishing any config, route, or migration files and adding the package trait to your User model. Because the project is old and lightly adopted, review the README and source before running it in a real app. Confirm that the service provider is auto-discovered and that published routes do not collide with your existing authentication endpoints.
- How does the package generate and validate magic login links?
- The package is described as generating signed, time-limited login links that are emailed to users and then validated to sign them in. It is not clear from the overview whether it uses Laravel signed URLs, database-backed tokens, or both, so inspect the source before trusting it. Verify how tokens are stored, whether they are hashed, whether they are single-use, and how expiry is enforced.
- Is soved/laravel-magic-auth safe to use in production?
- Treat it as high risk: it has very few stars, zero dependents, and no recent releases, so it has little ecosystem validation. Authentication is security-critical, and you must review token generation, storage, expiry, single-use enforcement, rate limiting, and guard integration yourself. For modern Laravel stacks, it is safer as a reference implementation or short-term accelerator than a long-term dependency.
- Does it support multiple guards or custom user providers?
- Multi-guard support is not confirmed by the package overview, so you should verify it in the source and with your own tests. Laravel applications with admin guards, API guards, or custom providers need explicit coverage for user resolution and session regeneration. Add tests for invalid users, cross-guard logins, and provider configuration before relying on it.
- How do I customize the magic link email and token lifetime?
- The package advertises configurable routes and customizable token lifetimes, which usually means publishing a config file and overriding the notification class. Review how the expiration value is read and enforced, and make sure the emailed URL uses your application's correct host and scheme. If you need branded emails or queued notifications, confirm the package supports swapping the notification before you build around it.
- How should I test magic-link authentication and expired or reused links?
- Write feature tests that cover successful login, expired links, reused links, unknown users, rate limits, and multi-guard scenarios. Use Laravel's notification fakes to capture the magic link and time travel to test expiry boundaries. Because the package is stale, these tests also act as your compatibility suite when upgrading Laravel or PHP.
- How does it handle email link scanners and prefetching?
- Email security scanners often prefetch links, which can consume single-use magic links before the user clicks. The package overview does not document prefetch protection, so verify whether links are consumed on GET or behind a confirmation step. A common mitigation is an interstitial page that requires a user action before the token is exchanged for a session.
- What are the alternatives to soved/laravel-magic-auth for passwordless login?
- The safest alternative is an owned flow built on Laravel's native signed temporary URLs plus a hashed token table, expiry, single-use consumption, rate limiting, and session regeneration. You can also evaluate maintained first-party or community passwordless packages and Laravel Fortify for related authentication features. For legacy applications, forking this MIT-licensed package may be reasonable if you accept ownership.
- How do I migrate away from or fork soved/laravel-magic-auth?
- Isolate the package behind an internal interface such as a MagicLinkAuthenticator so routes, notifications, and guard behavior can be swapped without touching call sites. Run the old and new flows behind a feature flag, invalidate old tokens, and validate with a canary cohort before removing the dependency. Fork only if you must preserve the legacy flow, and document runbooks, deprecation steps, and security review ownership.