Spatie Laravel One-Time Passwords

https://github.com/spatie/laravel-one-time-passwords
Admin
This project provides a secure way to create and consume one-time passwords (OTP) in Laravel...
Tokens:7,964
Snippets:79
Trust Score:10
License:MIT
Update:1 month ago
Show doc for...
Tokens:
Raw
### Composer install spatie/laravel-one-time-passwords

Source: https://github.com/spatie/laravel-one-time-passwords/blob/main/docs/installation-setup.md

Install the package with Composer using the require command.

```bash
composer require spatie/laravel-one-time-passwords
```

--------------------------------

### Custom alphanumeric password generator class

Source: https://github.com/spatie/laravel-one-time-passwords/blob/main/docs/configuring-security/configuring-password-format.md

Defines a custom password generator that implements `OneTimePasswordGenerator` and returns a 6-character alphanumeric string using `fake()->text()`. Note: the example is incomplete as it references `$this->numberOfCharacters` without defining it, and the `generate()` method is missing a semicolon.

```php
namespace App\Support;

use Spatie\OneTimePasswords\Support\PasswordGenerators\OneTimePasswordGenerator;


class AlphanumericPasswordGenerator implements OneTimePasswordGenerator
{
    public function generate(): string
    {
        return fake()->text($this->numberOfCharacters)
    }
}
```

--------------------------------

### Run the package test suite

Source: https://github.com/spatie/laravel-one-time-passwords/blob/main/README.md

Runs the package's test suite using Composer. Use this command to verify the package works correctly in your environment.

```bash
composer test
```

--------------------------------

### Publish and run one-time-passwords migrations

Source: https://github.com/spatie/laravel-one-time-passwords/blob/main/docs/installation-setup.md

Publish the migrations with the tag 'one-time-passwords-migrations' and then run the migrate command to create the one_time_passwords table.

```bash
php artisan vendor:publish --tag="one-time-passwords-migrations"
```

```bash
php artisan migrate
```

--------------------------------

### Basic Livewire component usage

Source: https://github.com/spatie/laravel-one-time-passwords/blob/main/docs/basic-usage/using-the-livewire-component.md

Renders a form that asks for the user's email and sends a one-time password. After submission, it displays a form to verify the code and logs the user in upon success.

```html
<livewire:one-time-password>
```

--------------------------------

### Publish package views

Source: https://github.com/spatie/laravel-one-time-passwords/blob/main/docs/basic-usage/using-the-livewire-component.md

Publishes the package's views to 'resources/views/vendor/one-time-passwords' for customization.

```bash
php artisan vendor:publish --tag=one-time-passwords-views
```

--------------------------------

### Publish one-time-passwords config file

Source: https://github.com/spatie/laravel-one-time-passwords/blob/main/docs/installation-setup.md

Publish the optional config file with the tag 'one-time-passwords-config'.

```bash
php artisan vendor:publish --tag="one-time-passwords-config"
```

--------------------------------

### Livewire component with redirect-to prop

Source: https://github.com/spatie/laravel-one-time-passwords/blob/main/docs/basic-usage/using-the-livewire-component.md

Passes the 'redirect-to' prop to customize the redirect URL after successful authentication, overriding the default from the config file.

```html
<livewire:one-time-password :redirect-to="route('home')">
```

--------------------------------

### Config file setting for custom password generator

Source: https://github.com/spatie/laravel-one-time-passwords/blob/main/docs/configuring-security/configuring-password-format.md

Shows how to set the `password_generator` key in `config/one-time-passwords.php` to use the custom `AlphanumericPasswordGenerator` class.

```php
// config/one-time-passwords.php

return [
    // ...

    'password_generator' => App\Support\AlphanumericPasswordGenerator::class,
];
```

--------------------------------

### Content of published one-time-passwords config file

Source: https://github.com/spatie/laravel-one-time-passwords/blob/main/docs/installation-setup.md

The default configuration file with settings for expiration minutes, active OTP limits, origin enforcement, password generation, rate limiting, and customizable actions.

```php
return [
    /*
     * One time passwords should be consumed within this number of minutes
     */
    'default_expires_in_minutes' => 2,

    /*
     * When this setting is active, we'll delete all previous one-time passwords for
     * a user when generating a new one
     */
    'only_one_active_one_time_password_per_user' => true,

    /*
     * When this option is active, we'll try to ensure that the one-time password can only
     * be consumed on the platform where it was requested on
     */
    'enforce_same_origin' => true,

    /*
     * This class is responsible to enforce that the one-time password can only be consumed on
     * the platform it was requested on.
     *
     * If you do not wish to enforce this, set this value to
     * Spatie\OneTimePasswords\Support\OriginInspector\DoNotEnforceOrigin
     */
    'origin_enforcer' => Spatie\OneTimePasswords\Support\OriginInspector\DefaultOriginEnforcer::class,

    /*
     * This class generates a random password
     */
    'password_generator' => Spatie\OneTimePasswords\Support\PasswordGenerators\NumericOneTimePasswordGenerator::class,

    /*
     * By default, the password generator will create a password with
     * this number of digits
     */
    'password_length' => 6,

    'redirect_successful_authentication_to' => '/dashboard',

    /*
     * These values are used to rate limit the number of attempts
     * that may be made to consume a one-time password.
     */
    'rate_limit_attempts' => [
        'max_attempts_per_user' => 5,
        'time_window_in_seconds' => 60,
    ],

    /*
     * The model uses to store one-time passwords
     */
    'model' => Spatie\OneTimePasswords\Models\OneTimePassword::class,

    /*
     * The notification used to send a one-time password to a user
     */
    'notification' => Spatie\OneTimePasswords\Notifications\OneTimePasswordNotification::class,

    /*
     * These class are responsible for performing core tasks regarding one-time passwords.
     * You can customize them by creating a class that extends the default, and
     * by specifying your custom class name here.
     */
    'actions' => [
        'create_one_time_password' => Spatie\OneTimePasswords\Actions\CreateOneTimePasswordAction::class,
        'consume_one_time_password' => Spatie\OneTimePasswords\Actions\ConsumeOneTimePasswordAction::class,
    ],
]; 
```

--------------------------------

### Configure custom model in one-time-passwords.php

Source: https://github.com/spatie/laravel-one-time-passwords/blob/main/docs/advanced-usage/using-your-own-model.md

Update the configuration file to use your custom model. Replace the default model with the fully qualified class name of your custom model.

```php
// config/one-time-passwords.php

return [
    // ...
    'models' => [
        // The model used to store one-time passwords
        'model' => App\Models\CustomOneTimePassword::class,
    ],
];
```

--------------------------------

### Create a custom OneTimePassword model

Source: https://github.com/spatie/laravel-one-time-passwords/blob/main/docs/advanced-usage/using-your-own-model.md

Create a custom model by extending the package's base model. This allows you to change low-level behavior such as table name, database connection, custom properties, or method overrides.

```php
namespace App\Models;

use Spatie\OneTimePasswords\Models\OneTimePassword as BaseOneTimePassword;

class CustomOneTimePassword extends BaseOneTimePassword
{
    // Add any custom properties or methods here
}
```

--------------------------------

### Livewire component with email prop

Source: https://github.com/spatie/laravel-one-time-passwords/blob/main/docs/basic-usage/using-the-livewire-component.md

Passes the 'email' prop to skip the email input and directly show the one-time password form.

```html
<livewire:one-time-password email="johndoe@example.com">
```

--------------------------------

### Custom CreateOneTimePasswordAction class

Source: https://github.com/spatie/laravel-one-time-passwords/blob/main/docs/advanced-usage/customizing-actions.md

Create a custom action class that extends the default CreateOneTimePasswordAction. Override the execute method to add custom logic after the one-time password is stored, then return the password.

```php
namespace App\Actions;

use Spatie\OneTimePasswords\Actions\CreateOneTimePasswordAction

class CustomCreateOneTimePasswordAction extends CreateOneTimePasswordAction
{
    public function execute(
        Authenticatable $user,
        ?int $expiresInMinutes = null,
        ?Request $request = null
    ): OneTimePassword {
        // Call the parent method to store the one-time password
        $oneTimePassword = parent::execute($user, $expiresInMinutes, $request);

        // Add your custom logic here
        
        // Don't forget to return the one-time password
        return $oneTimePassword;
    }
}
```

--------------------------------

### Register custom action in config/one-time-passwords.php

Source: https://github.com/spatie/laravel-one-time-passwords/blob/main/docs/advanced-usage/customizing-actions.md

Register the custom action class in the config file under the 'actions' array, using the 'create_one_time_password' key.

```php
// config/one-time-passwords.php

return [
    // ...
    'actions' => [
        'create_one_time_password' => App\Actions\CustomCreateOneTimePasswordAction::class,
    ],
];
```

--------------------------------

### Prepare User model with HasOneTimePasswords trait

Source: https://github.com/spatie/laravel-one-time-passwords/blob/main/docs/installation-setup.md

Use the HasOneTimePasswords trait in your User model to enable one-time password functionality.

```php
namespace App\Models;

use Spatie\OneTimePasswords\Models\Concerns\HasOneTimePasswords;

class User
{
    use HasOneTimePasswords;
    
    // ...
}
```

--------------------------------

### Login with one-time password using attemptLoginUsingOneTimePassword

Source: https://github.com/spatie/laravel-one-time-passwords/blob/main/docs/basic-usage/consuming-one-time-passwords.md

Use this snippet in a login flow to verify a one-time password and log in the user. It returns a ConsumeOneTimePasswordResult enum instance. On success, it is best practice to regenerate the session ID and redirect to the intended dashboard. On failure, it returns back with a validation error for the one_time_password field.

```php
use Spatie\OneTimePasswords\Enums\ConsumeOneTimePasswordResult;

// $result is an instance of the ConsumeOneTimePasswordResult enum.
$result = $user->attemptLoginUsingOneTimePassword($oneTimePassword, remember: false);

if ($result->isOk()) {
     // it is best practice to regenerate the session id after a login   
     $request->session()->regenerate();
              
     return redirect()->intended('dashboard');
}

return back()->withErrors([
    'one_time_password' => $result->validationMessage(),
])->onlyInput('one_time_password');
```

--------------------------------

### Disable origin enforcement via config

Source: https://github.com/spatie/laravel-one-time-passwords/blob/main/docs/configuring-security/enforcing-origin.md

Sets the origin_enforcer config option to DoNotEnforceOrigin to disable origin enforcement. Place this in the one-time-passwords.php config file.

```php
// config/one-time-passwords.php

return [
    // ...

    'origin_enforcer' => Spatie\OneTimePasswords\Support\OriginInspector\DoNotEnforceOrigin::class,
];
```

--------------------------------

### Send one-time password

Source: https://github.com/spatie/laravel-one-time-passwords/blob/main/docs/basic-usage/creating-one-time-passwords.md

Creates a one-time password and sends it to the user's email using the OneTimePasswordNotification notification. Older passwords for the user are deleted.

```php
$user->sendOneTimePassword();
```

--------------------------------

### Attempt login using one-time password

Source: https://github.com/spatie/laravel-one-time-passwords/blob/main/docs/introduction.md

Attempts to log in a user with a one-time password. If successful, regenerates the session and redirects to the intended dashboard; otherwise returns back with a validation error.

```php
use Spatie\OneTimePasswords\Enums\ConsumeOneTimePasswordResult;

$result = $user->attemptLoginUsingOneTimePassword($oneTimePassword);

if ($result->isOk()) {
     // it is best practice to regenerate the session id after a login   
     $request->session()->regenerate();
             
     return redirect()->intended('dashboard');
}

return back()->withErrors([
    'one_time_password' => $result->validationMessage(),
])->onlyInput('one_time_password');
```

--------------------------------

### Send one-time password to a user

Source: https://github.com/spatie/laravel-one-time-passwords/blob/main/docs/introduction.md

Sends a mail containing a one-time password to the user. The default password is six digits long and expires in 2 minutes.

```php
// send a mail containing a one-time password

$user->sendOneTimePassword();
```

--------------------------------

### Attempt login using a one-time password

Source: https://github.com/spatie/laravel-one-time-passwords/blob/main/README.md

Attempts to log in a user with a one-time password. Checks the result and redirects to the intended dashboard on success, or returns back with validation errors on failure.

```php
use Spatie\OneTimePasswords\Enums\ConsumeOneTimePasswordResult;

$result = $user->attemptLoginUsingOneTimePassword($oneTimePassword);

if ($result->isOk()) {
    return redirect()->intended('dashboard');
}

return back()->withErrors([
    'one_time_password' => $result->validationMessage(),
])->onlyInput('one_time_password');
```

--------------------------------

### Extend OneTimePasswordNotification to add Vonage SMS channel

Source: https://github.com/spatie/laravel-one-time-passwords/blob/main/docs/basic-usage/configuring-notifications.md

Create a custom notification class extending Spatie\OneTimePasswords\Notifications\OneTimePasswordNotification. Override the via method to return ['vonage'] and implement toVonage to send the one-time password via SMS. The $this->oneTimePassword property is an instance of the OneTimePassword model.

```php
namespace App\Notifications;

use Spatie\OneTimePasswords\Notifications\OneTimePasswordNotification;

class CustomOneTimePasswordNotification extends OneTimePasswordNotification
{
    public function via($notifiable): string|array
    {
        return ['vonage'];
    }

    public function toVonage(object $notifiable): VonageMessage
    {
        // $this->oneTimePassword is an instance of the Spatie\OneTimePasswords\OneTimePassword model
    
        return (new VonageMessage)
            ->content("Your one-time login code is: {$this->oneTimePassword->password}");
    }
}
```

--------------------------------

### Schedule daily pruning of expired one-time passwords

Source: https://github.com/spatie/laravel-one-time-passwords/blob/main/docs/installation-setup.md

Add the model:prune command to your schedule to delete expired one-time passwords daily, using the MassPrunable trait.

```php
use Spatie\OneTimePasswords\Models\OneTimePassword;

Schedule::command('model:prune', [
    '--model' => [OneTimePassword::class],
])->daily();
```

--------------------------------

### Create one-time password without sending

Source: https://github.com/spatie/laravel-one-time-passwords/blob/main/docs/basic-usage/creating-one-time-passwords.md

Creates a one-time password without sending it. Returns an instance of the newly created OneTimePassword model.

```php
$oneTimePasswordModel = $user->createOneTimePassword();
```

--------------------------------

### Consume one-time password without login using consumeOneTimePassword

Source: https://github.com/spatie/laravel-one-time-passwords/blob/main/docs/basic-usage/consuming-one-time-passwords.md

Use this snippet to verify a one-time password without logging in the user. It behaves like attemptLoginUsingOneTimePassword but does not perform the login. The result is a ConsumeOneTimePasswordResult enum instance.

```php
$result = $user->consumeOneTimePassword($oneTimePassword);
```

--------------------------------

### Update config to use custom notification class

Source: https://github.com/spatie/laravel-one-time-passwords/blob/main/docs/basic-usage/configuring-notifications.md

Update the 'notification' key in the config/one-time-passwords.php file to point to your custom notification class. This tells the package to use your extended notification instead of the default one.

```php
// config/one-time-passwords.php

return [
    // ...
    'notification' => App\Notifications\CustomOneTimePasswordNotification::class
];
```

--------------------------------

### Add routeNotificationForVonage to User model

Source: https://github.com/spatie/laravel-one-time-passwords/blob/main/docs/basic-usage/configuring-notifications.md

Add the routeNotificationForVonage method to the User model to complete SMS routing. This method should return the phone number where the notification will be sent.

```php
namespace App\Models;
 
use Illuminate\Foundation\Auth\User as Authenticatable;
use Illuminate\Notifications\Notifiable;
use Illuminate\Notifications\Notification;
 
class User extends Authenticatable
{
    use Notifiable;
 
    /**
     * Route notifications for the Vonage channel.
     */
    public function routeNotificationForVonage(Notification $notification): string
    {
        return $this->phone_number;
    }
}
```

--------------------------------

### OriginEnforcer interface definition

Source: https://github.com/spatie/laravel-one-time-passwords/blob/main/docs/configuring-security/enforcing-origin.md

Defines the interface that custom origin enforcers must implement. The gatherProperties method returns an array of properties identifying the request origin, and verifyProperties returns true if the properties match.

```php
use Illuminate\Http\Request;
use Spatie\OneTimePasswords\Models\OneTimePassword;

interface OriginEnforcer
{
    /** @return array<string, string|int> */
    public function gatherProperties(Request $request): array;

    public function verifyProperties(OneTimePassword $oneTimePassword, Request $request): bool;
}
```
Tokens:
Raw