About Opensource two factor authentication
Time-based one-time password (TOTP) that can be retrieved from any TOTP compatible mobile authentication application such as Google Authenticator.Before getting started, you should first ensure that your application's App\Models\User model uses the Laravel\Fortify\TwoFactorAuthenticatable trait: 1 2 3namespace App\Models; 4 5use Illuminate\Foundation\Auth\User as Authenticatable; 6use Illuminate\Notifications\Notifiable; 7use Laravel\Fortify\TwoFactorAuthenticatable; 8 9class User extends Authenticatable10{11 use Notifiable, TwoFactorAuthenticatable;12}Next, you should build a screen within your application where users can manage their two factor authentication settings. This screen should allow the user to enable and disable two factor authentication, as well as regenerate their two factor authentication recovery codes.By default, the features array of the fortify configuration file instructs Fortify's two factor authentication settings to require password confirmation before modification. Therefore, your application should implement Fortify's password confirmation feature before continuing.Enabling Two Factor AuthenticationTo begin enabling two factor authentication, your application should make a POST request to the /user/two-factor-authentication endpoint defined by Fortify. If the request is successful, the user will be redirected back to the previous URL and the status session variable will be set to two-factor-authentication-enabled. You may detect this status session variable within your templates to display the appropriate success message. If the request was an XHR request, 200 HTTP response will be returned.After choosing to enable two factor authentication, the user must still "confirm" their two factor authentication configuration by providing a valid two factor authentication code. So, your "success" message should instruct the user that two factor authentication confirmation is still required:1@if (session('status') == 'two-factor-authentication-enabled')2 div class="mb-4 font-medium text-sm">3 Please finish configuring two factor authentication below.4 div>5@endifNext, you should display the two factor authentication QR code for the user to scan into their authenticator application. If you are using Blade to render your application's frontend, you may retrieve the QR code SVG using the twoFactorQrCodeSvg method available on the
Key features of the Opensource two factor authentication that are enabled through these drivers include:
- Two-Factor Authentication for SSH
- Two-Factor Authentication on Magic
- inSite.gsa.gov - Two-Factor Authentication
- Two-Factor Authentication F.A.Q
- Two-factor authentication with KeePassXC
- Two Factor Authentication for CORE
- Two factor authenticator for online
User instance:1$request->user()->twoFactorQrCodeSvg();If you are building a JavaScript powered frontend, you may make an XHR GET request to the /user/two-factor-qr-code endpoint to retrieve the user's two factor authentication QR code. This endpoint will return a JSON object containing an svg key.Confirming Two Factor AuthenticationIn addition to displaying the user's two factor authentication QR code, you should provide a text input where the user can supply a valid authentication code to "confirm" their two factor authentication configuration. This code should be provided to the Laravel application via a POST request to the /user/confirmed-two-factor-authentication endpoint defined by Fortify.If the request is successful, the user will be redirected back to the previous URL and the status session variable will be set to two-factor-authentication-confirmed:1@if (session('status') == 'two-factor-authentication-confirmed')2 div class="mb-4 font-medium text-sm">3 Two factor authentication confirmed and enabled successfully.4 div>5@endifIf the request to the two factor authentication confirmation endpoint was made via an XHR request, a 200 HTTP response will be returned.Displaying the Recovery CodesYou should also display the user's two factor recovery codes. These recovery codes allow the user to authenticate if they lose access to their mobile device. If you are using Blade to render your application's frontend, you may access the recovery codes via the authenticated user instance:1(array) $request->user()->recoveryCodes()If you are building a JavaScript powered frontend, you may make an XHR GET request to the /user/two-factor-recovery-codes endpoint. This endpoint will return a JSON array containing the user's recovery codes.To regenerate the user's recovery codes, your application should make a POST request to the /user/two-factor-recovery-codes endpoint.Authenticating With Two Factor AuthenticationDuring the authentication process, Fortify will automatically redirect the user to your application's two factor authentication challenge screen. However, if your application is making an XHR login request, the JSON response returned after a successful authentication attempt will contain a JSON object that has a
