Weave Code
:closed_lock_with_key: A PHP library for generating one time passwords according to RFC 4226 (HOTP) and the RFC 6238 (TOTP)
Frequently asked questions about Otphp
- How do I integrate spomky-labs/otphp into Laravel for Google Authenticator support?
- Start by requiring the package via Composer (`composer require spomky-labs/otphp`), then register it as a service provider in `config/app.php`. Use the builder pattern to create TOTP/HOTP instances (e.g., `TOTP::createFromSecret($secret)->withIssuer('AppName')`) and generate provisioning URIs for QR codes. Store the URI or secret in your users table.
- What Laravel versions does spomky-labs/otphp support?
- The package is officially tested with Laravel 9+ and PHP 8.1+. For older Laravel versions (8.x), use version 9.x of otphp. Always check the [GitHub releases](https://github.com/Spomky-Labs/otphp/releases) for compatibility notes before upgrading.
- Can I use spomky-labs/otphp with Laravel Sanctum or Passport for MFA?
- Yes. Integrate otphp into your Sanctum/Passport flows by extending Laravel’s `AuthenticatesUsers` trait or creating a custom guard. Use `TOTP::verify($code)` in your login logic and store OTP secrets/URIs in the users table. For Sanctum, add OTP checks to the `authenticate` method.
- How do I handle time drift in TOTP verification (e.g., user clock issues)?
- Configure leeway to account for minor clock skew using `->withLeeway(2)` (default is 1). Store this setting per-user or globally in `config/otp.php`. For example: `$totp->withLeeway(3)` allows a 3-second window before/after the expected OTP time. Adjust based on your app’s tolerance for time variance.
- Should I store just the OTP secret or the full provisioning URI in the database?
- Store the full provisioning URI (e.g., `otpauth://totp/...`) for future-proofing, as it includes issuer, label, and algorithm details. Secrets alone risk breaking compatibility if configuration changes later. Use a `otp_secrets` table or add columns to your users table (e.g., `otp_secret`, `otp_uri`).
- How can I generate QR codes for OTP setup in Laravel?
- Use the `getProvisioningUri()` method to generate the OTPAuth URI, then pass it to a QR code library like `endroid/qr-code` or `simple-qrcode`. Example: `$qrCode = QrCode::size(200)->generate($totp->getProvisioningUri())->save('otp-qr.png');`. Avoid deprecated Google Charts for QR generation.
- Does spomky-labs/otphp support HOTP (counter-based) OTPs for offline use?
- Yes. Use `HOTP::createFromSecret($secret)` for counter-based OTPs, ideal for offline or hardware tokens. Store the current counter in your database and update it post-verification (e.g., `$hotp->verify($code, $counter)`). This is useful for scenarios where time synchronization isn’t reliable.
- How do I configure spomky-labs/otphp for Laravel’s caching (Redis/Memcached)?
- OTP objects are stateless, so cache them using Laravel’s cache facade. For example, store a TOTP instance for 1 hour: `cache()->remember('user_otp_'.$user->id, 3600, fn() => TOTP::createFromSecret($user->otp_secret)->withIssuer('AppName'))`. This reduces redundant secret lookups and improves performance.
- What security best practices should I follow when using spomky-labs/otphp?
- Enforce Base32 encoding for secrets (otphp throws `SecretDecodingException` if invalid), use Laravel’s encryption facade for storage, and avoid SHA-1 (default is SHA-256). Store backup codes separately (encrypted) and implement rate limiting (e.g., Laravel’s throttle middleware) to prevent brute-force attacks on OTP verification.
- Are there alternatives to spomky-labs/otphp for Laravel OTPs?
- Other options include `paragonie/googleauthenticator` (older, less maintained) or `bacon/bacon-qr` (for QR generation only). However, otphp is the most RFC-compliant, actively maintained, and Laravel-optimized choice, with built-in support for provisioning URIs, events, and modern PHP features. It’s also lighter (~1MB) than alternatives with external dependencies.
Weaver
How can I help you explore Laravel packages today?