To implement two-factor authentication in Laravel, use Laravel Fortify with the pragmarx/google2fa-laravel package. 1. Install Laravel Fortify and run migrations. 2. Install the Google2FA package via Composer. 3. Add two_factor_enabled and two_factor_secret columns to the users table via migration. 4. Use the TwoFactorAuthenticatable trait in the User model. 5. Create a controller to generate and verify TOTP codes for 2FA setup. 6. Create a two-factor challenge view for code input during login. 7. Optionally generate and store encrypted recovery codes. Fortify automatically handles 2FA verification if enabled, redirecting users to the challenge screen upon login. This approach ensures secure, app-based 2FA using tools like Google Authenticator and Authy, providing a robust security layer for your Laravel application.

Implementing two-factor authentication (2FA) in Laravel can greatly improve the security of your application. While Laravel doesn’t include 2FA out of the box, it’s easy to add using packages or custom logic. Here's a practical guide on how to do it effectively.

1. Use Laravel Fortify or Laravel Breeze with a 2FA Package

The easiest and most secure way is to use Laravel Fortify (a backend authentication scaffolding) along with Google2FA or Spatie’s Laravel 2FA package.

Step 1: Install Laravel Fortify (if not already installed)

composer require laravel/fortify
php artisan vendor:publish --provider="Laravel\Fortify\FortifyServiceProvider"

Then run migrations:

php artisan migrate

Install Fortify with basic features:

php artisan fortify:install

Note: If you're using Laravel Breeze or Jetstream, you may already have authentication scaffolding.

2. Install Google2FA Package

We'll use pragmarx/google2fa-laravel for TOTP (Time-Based One-Time Password) generation.

composer require pragmarx/google2fa-laravel

Add the service provider (only for Laravel < 5.5 or if package discovery is disabled):

// config/app.php
'providers' => [
    // ...
    PragmaRX\Google2FALaravel\ServiceProvider::class,
],

Publish the config (optional):

php artisan vendor:publish --provider="PragmaRX\Google2FALaravel\ServiceProvider"

3. Update Your User Model

Add a few fields to store 2FA data:

php artisan make:migration add_two_factor_columns_to_users_table --table=users

In the migration:

public function up()
{
    Schema::table('users', function (Blueprint $table) {
        $table->boolean('two_factor_enabled')->default(false);
        $table->string('two_factor_secret')->nullable();
    });
}

Run the migration:

php artisan migrate

Now, update your User model:

// app/Models/User.php
use Illuminate\Foundation\Auth\User as Authenticatable;
use Laravel\Fortify\TwoFactorAuthenticatable;

class User extends Authenticatable
{
    use TwoFactorAuthenticatable;

    protected $fillable = [
        'name',
        'email',
        'password',
        'two_factor_enabled',
        'two_factor_secret',
    ];

    protected $appends = ['two_factor_enabled'];
}

Note: The TwoFactorAuthenticatable trait (from Fortify) adds 2FA helpers. If you're not using Fortify, you’ll need to implement logic manually.

4. Enable 2FA for a User

Create a controller to handle 2FA setup:

// app/Http/Controllers/TwoFactorController.php
namespace App\Http\Controllers;

use App\Models\User;
use Illuminate\Http\Request;
use PragmaRX\Google2FALaravel\Facade as Google2FA;

class TwoFactorController extends Controller
{
    public function show()
    {
        $user = auth()->user();
        $google2fa = Google2FA::generateSecretKey();
        $user->two_factor_secret = $google2fa;
        $user->save();

        $QRImage = Google2FA::getQRCodeInline(
            config('app.name'),
            $user->email,
            $google2fa
        );

        return view('auth.two-factor-setup', compact('QRImage', 'google2fa'));
    }

    public function enable(Request $request)
    {
        $request->validate(['one_time_password' => 'required']);

        $secret = $request->user()->two_factor_secret;
        $valid = Google2FA::verifyKey($secret, $request->one_time_password);

        if ($valid) {
            $request->user()->update(['two_factor_enabled' => true]);
            return redirect()->route('dashboard')->with('status', '2FA enabled!');
        }

        return back()->withErrors(['one_time_password' => 'Invalid code.']);
    }

    public function disable(Request $request)
    {
        $request->user()->update([
            'two_factor_enabled' => false,
            'two_factor_secret' => null,
        ]);

        return redirect()->route('dashboard')->with('status', '2FA disabled.');
    }
}

5. Update Login to Require 2FA

Laravel Fortify automatically handles 2FA if the user has it enabled and the TwoFactorAuthenticatable trait is used.

Ensure in app/Providers/FortifyServiceProvider.php:

use Laravel\Fortify\Fortify;

Fortify::loginView(fn () => view('auth.login'));

When a user logs in:

• If 2FA is enabled, Fortify redirects to /two-factor-challenge.
• You need to create this view.

Create the challenge view:

{{-- resources/views/auth/two-factor-challenge.blade.php --}}
<form method="POST" action="{{ route('two-factor.login') }}">
    @csrf
    <label>Authentication Code</label>
    <input type="text" name="code" autofocus>
    <button type="submit">Verify</button>
</form>

{{-- Or backup code --}}
<form method="POST" action="{{ route('two-factor.login') }}">
    @csrf
    <input type="hidden" name="recovery_code" value="1">
    <button type="submit">Use Recovery Code</button>
</form>

6. Generate Recovery Codes (Optional but Recommended)

You should generate and store encrypted recovery codes for users in case they lose access.

Example:

// In your setup method
$recoveryCodes = collect(range(1, 8))->map(fn () => Str::random(10))->toArray();
$user->update(['two_factor_recovery_codes' => $recoveryCodes]); // stored as JSON

You’ll need to add a two_factor_recovery_codes text or JSON column in the users table.

7. Protect Routes or Views

You can check if 2FA is enabled:

if (auth()->user()->two_factor_enabled) {
    // Require 2FA
}

Or use middleware if needed.

Summary

To implement 2FA in Laravel:

• ? Use Laravel Fortify or Jetstream for solid foundation
• ? Install pragmarx/google2fa-laravel
• ? Add two_factor_enabled and two_factor_secret to users table
• ? Use TwoFactorAuthenticatable trait
• ? Create routes and views for setup and challenge
• ? Handle verification using TOTP
• ? Optionally support recovery codes

This setup supports authenticator apps like Google Authenticator, Authy, etc.

Basically, it’s secure, widely used, and not overly complex once you follow the steps.

The above is the detailed content of How to implement two-factor authentication in Laravel?. For more information, please follow other related articles on the PHP Chinese website!