Uh oh!
There was an error while loading. Please reload this page.
Add opt-in two-factor authentication via Laravel Fortify - #352
Open
sandervanhooft wants to merge 1 commit into
Open
Add opt-in two-factor authentication via Laravel Fortify#352sandervanhooft wants to merge 1 commit into
sandervanhooft wants to merge 1 commit into
Conversation
Unified TOTP 2FA at /login that protects both the public site and the Filament admin panel through the shared web session. Fortify runs headless (routes ignored) alongside the existing laravel/ui login; only the 2FA challenge and management flows are wired in. - LoginController redirects password-verified users with confirmed 2FA to the challenge instead of authenticating; SSO logins are unaffected - Two-factor management (enable/confirm/disable/regenerate) added to the Profile Livewire component with password confirmation - Tailwind challenge view and profile UI (QR, setup key, recovery codes) - Adds two_factor_secret/recovery_codes/confirmed_at columns - 15 Pest tests covering the challenge flow and management
sandervanhooft
commented
Sep 4, 2026
Author
not manually tested yet |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds opt-in two-factor authentication (TOTP) using Laravel Fortify, wired into the existing
laravel/uilogin flow. The public site and the Filament admin panel share the samewebguard and session, so placing the 2FA challenge at/loginprotects both surfaces with a single enrollment and a single challenge — no separate admin-panel 2FA needed.Fortify runs headless (
Fortify::ignoreRoutes()); only the two-factor challenge and management flows are registered, so nothing conflicts with the existingAuth::routes()login / registration / password-reset controllers.What's included
/two-factor-challenge(authenticator code or recovery code) instead of being logged in. SSO / Socialite logins are unaffected (the IdP handles MFA there).two_factor_secret,two_factor_recovery_codes,two_factor_confirmed_at.TwoFactorAuthenticatableon theUsermodel; the secret and recovery codes are hidden from serialization.Testing
Notes
php artisan migrateto add the new columns.