To implement 2FA in Laravel, use packages like pragmarx/google2fa-laravel or spatie/laravel-google2fa. 1. Install and publish the package configuration. 2. Add a 'google2fa_secret' column to the users table via migration. 3. Generate a secret key and display a QR code for the user to scan with an authenticator app. 4. Verify the one-time password during login, optionally adjusting the window size for clock drift. 5. Provide recovery options like backup codes to handle lost access securely.

Setting up two-factor authentication (2FA) in Laravel is more straightforward than you might think, especially with packages like Google2FA or Spatie Laravel Google Authenticator. The main idea is to add a second layer of security beyond passwords—usually a time-based one-time password (TOTP)—so even if someone gets your password, they still can’t log in without that second code.

Here’s how to implement it effectively:

1. Choose the Right Package

Laravel doesn’t include 2FA out of the box, but there are solid community packages that make integration easy. Two popular options are:

• pragmarx/google2fa-laravel: A wrapper around the Google2FA library, good for basic TOTP support.
• spatie/laravel-google2fa: Another solid option with more built-in features like recovery codes and UI helpers.

You’ll usually go with one of these unless you need something custom or enterprise-grade like WebAuthn (which is a different story).

To install the first package:

composer require pragmarx/google2fa-laravel

Then publish the config:

php artisan vendor:publish --provider="PragmaRX\Google2FA\Google2FAServiceProvider"

2. Add 2FA Fields to Your User Model

You’ll need to store a secret key for each user. This key is used to generate and verify TOTP codes.

Run a migration:

php artisan make:migration add_google2fa_secret_to_users

In the migration file:

Schema::table('users', function (Blueprint $table) {
    $table->string('google2fa_secret')->nullable();
});

Then run:

php artisan migrate

Now your users can have their own 2FA secrets stored securely.

3. Generate and Display the QR Code

Once the user enables 2FA, you need to generate a secret and show them a QR code to scan with an app like Google Authenticator or Authy.

In your controller:

use PragmaRX\Google2FA\Google2FA;

$google2fa = new Google2FA();

$secret = $google2fa->generateSecretKey();

// Store the secret temporarily or save it to the user model
$user->update(['google2fa_secret' => $secret]);

$qrCodeUrl = $google2fa->getQRCodeUrl(
    config('app.name'),
    $user->email,
    $secret
);

Pass $qrCodeUrl to your view and display the QR code as an image. The user scans this with their authenticator app.

4. Verify the One-Time Password

After the user sets up their app, they’ll enter a generated code during login. You need to verify that code against their secret.

In your login flow:

use PragmaRX\Google2FA\Google2FA;

$google2fa = new Google2FA();

if (! $google2fa->verifyKey($user->google2fa_secret, $request->input('one_time_password'))) {
    return back()->withErrors(['one_time_password' => 'Invalid 2FA code']);
}

This should happen after the regular password check. If the code is invalid, deny access.

You might want to allow some flexibility by setting window size (number of previous/future codes allowed), which can help with clock drift issues:

$google2fa->setWindow(1); // allows one previous or future code

5. Handle Recovery Options

If a user loses access to their authenticator app, they’ll need a way back in. Common approaches include:

• Backup codes (generated and saved when 2FA is enabled)
• Email-based recovery (less secure but common)
• Admin override (for internal apps)

Backup codes are the most typical solution. When enabling 2FA, generate a few codes and let the user download or print them. Store them securely (e.g., encrypted in the DB or hashed if possible).

Implementing 2FA in Laravel isn’t too hard once you’ve got the right tools and flow in place. It adds a small amount of complexity to your login process, but it significantly boosts account security. Just remember to test the whole flow yourself from setup to verification—and don’t forget recovery paths.

The above is the detailed content of Implementing Two-Factor Authentication in Laravel?. For more information, please follow other related articles on the PHP Chinese website!