Skip to content

Commit 910fcb2

Browse files
author
David Shen
committed
MFA
1 parent e47d78f commit 910fcb2

16 files changed

+292
-150
lines changed

‎README.md‎

Lines changed: 58 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -39,18 +39,16 @@ php artisan vendor:publish --provider="Sicaboy\LaravelSecurity\LaravelSecuritySe
3939
Siaboy\LaravelSecurity\LaravelSecurityServiceProvider::class,
4040
```
4141

42-
# Validators
4342

44-
## Available Rules
43+
# Features
4544

46-
- [NotCommonPassword](src/Rules/NotCommonPassword.php) - Avoid user to use a common used password
47-
48-
- [NotAUsedPassword](src/Rules/NotAUsedPassword.php) - Avoid user to use a password which has been used before
45+
## Disallow user to use a common password or a used password
4946

47+
#### Available validators rules
5048

51-
## Features
49+
- [NotCommonPassword](src/Rules/NotCommonPassword.php) - Avoid user to use a common used password
5250

53-
### Disallow user to use a common password or a used password
51+
- [NotAUsedPassword](src/Rules/NotAUsedPassword.php) - Avoid user to use a password which has been used before
5452

5553
```php
5654
// Add rule instance to the field validation rules list
@@ -85,15 +83,17 @@ While there is an extra event you should add to call explicitly.
8583
event(new \Illuminate\Auth\Events\PasswordReset($user));
8684
```
8785

88-
### Password Policy
86+
## Password Policies
87+
88+
#### Available policies
8989

9090
- Delete accounts with days of no activity
9191
- Lock out accounts with days of no activity
9292
- Force change password
9393

94-
You can enable function needed by setting config `enabled` to `true` in `config/laravel-security.php`
94+
1. Enable function needed by setting config `enabled` to `true` in `config/laravel-security.php`
9595

96-
```
96+
```php
9797
'password_policy' => [
9898
// Delete accounts with days of no activity
9999
'auto_delete_inactive_accounts' => [
@@ -115,6 +115,54 @@ You can enable function needed by setting config `enabled` to `true` in `config/
115115
]
116116
```
117117

118+
2. If you force user change password every x days, you will need to use this middleware
119+
120+
```php
121+
Route::middleware(['security'])->group(function () {
122+
...
123+
});
124+
```
125+
126+
127+
3. Add the following commands to `app/Console/Kernel.php` of your application
128+
129+
```php
130+
protected function schedule(Schedule $schedule)
131+
{
132+
$schedule->command(\Sicaboy\LaravelSecurity\Console\Commands\DeleteInactiveAccounts::class)
133+
->hourly();
134+
$schedule->command(\Sicaboy\LaravelSecurity\Console\Commands\LockoutInactiveAccounts::class)
135+
->hourly();
136+
...
137+
}
138+
```
139+
3. Make sure you add the [Laravel scheduler](https://laravel.com/docs/7.x/scheduling#introduction) in your crontab
140+
141+
```
142+
* * * * * cd /path-to-your-project && php artisan schedule:run >> /dev/null 2>&1
143+
```
144+
145+
## Multi-factor Authentication
146+
147+
1. Enable function needed by setting config `enabled` to `true` in `config/laravel-security.php`
148+
149+
```php
150+
'multi_factor_authentication' => [
151+
'enabled' => false,
152+
...
153+
]
154+
```
155+
156+
2. Attach the middleware to your routes to protect your pages.
157+
158+
```php
159+
160+
Route::middleware(['mfa'])->group(function () {
161+
...
162+
});
163+
```
164+
165+
118166
## Change log
119167

120168
Please see [CHANGELOG](CHANGELOG.md) for more information on what has changed recently.

‎config/laravel-security.php‎

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -4,12 +4,15 @@
44

55
'multi_factor_authentication' => [
66
'enabled' => false,
7-
'email_notification' => [
8-
'enabled' => true,
7+
'template' => 'laravel-security.mfa.form',
8+
'code_expire_after_minutes' => 10,
9+
'email' => [
910
//'mailable' => Sicaboy\LaravelSecurity\Mail\AuthenticationCodeMailable::class,
10-
'template' => 'laravel-security.emails.authentication-code',
11+
'template' => 'laravel-security::emails.authentication-code',
1112
'subject' => 'Login authentication code',
1213
],
14+
// @todo
15+
// 'sms' => []
1316
],
1417

1518
'password_policy' => [
@@ -20,7 +23,7 @@
2023
'email_notification' => [
2124
'enabled' => true,
2225
//'mailable' => Sicaboy\LaravelSecurity\Mail\AccountTerminatedMailable::class,
23-
'template' => 'laravel-security.emails.account-terminated',
26+
'template' => 'laravel-security::emails.account-terminated',
2427
'subject' => 'Your account has been terminated',
2528
],
2629
],
@@ -32,7 +35,7 @@
3235
'email_notification' => [
3336
'enabled' => true,
3437
//'mailable' => Sicaboy\LaravelSecurity\Mail\AccountLockedMailable::class,
35-
'template' => 'laravel-security.emails.account-locked',
38+
'template' => 'laravel-security::emails.account-locked',
3639
'subject' => 'Your account has been locked due to no activity',
3740
],
3841
],

‎resources/views/emails/account-locked.blade.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
@extends('laravel-security.emails.base')
1+
@extends('laravel-security::emails.base')
22

33
@section('content')
44
<p class="lead">

‎resources/views/emails/account-terminated.blade.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
@extends('laravel-security.emails.base')
1+
@extends('laravel-security::emails.base')
22

33
@section('content')
44
<p class="lead">

‎resources/views/emails/authentication-code.blade.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
@extends('laravel-security.emails.base')
1+
@extends('laravel-security::emails.base')
22

33
@section('content')
44
<p class="lead">

‎resources/views/emails/base.blade.php‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -117,10 +117,12 @@
117117
<tr>
118118
<td>
119119
{{--<img src="{{ config('app.url') }}/images/logo-mail.png" />--}}
120+
<h3 class="collapse">
121+
{{ config('app.name') }}
122+
</h3>
120123
</td>
121124
<td align="right">
122125
<h6 class="collapse">
123-
{{ config('app.name') }}
124126
</h6>
125127
</td>
126128
</tr>

‎resources/views/mfa/form.blade.php‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
@extends('layouts.app')
2+
3+
@section('content')
4+
<div class="container">
5+
<div class="row justify-content-center">
6+
<div class="col-md-8">
7+
<div class="card">
8+
<div class="card-header">{{ __('Multi-factor Authentication') }}</div>
9+
10+
<div class="card-body">
11+
<form method="POST" action="" aria-label="{{ __('Multi-factor Authentication') }}">
12+
@csrf
13+
14+
<input type="hidden" name="referer" value="{{ $referer }}">
15+
16+
<div class="alert alert-secondary" role="alert">
17+
{{ __("The authentication code has been sent to your e-mail and the code will expire after :minutes minutes.", ['minutes' => $minutes]) }}
18+
</div>
19+
<div class="form-group row">
20+
<label for="code" class="col-md-4 col-form-label text-md-right">{{ __('Auth Code') }}</label>
21+
22+
<div class="col-md-6">
23+
<input id="code" type="text" class="form-control{{ $errors->has('code') ? ' is-invalid' : '' }}" name="code" value="{{ $code ?? old('code') }}" required autofocus>
24+
@if ($errors->has('code'))
25+
<span class="invalid-feedback" role="alert">
26+
<strong>{{ $errors->first('code') }}</strong>
27+
</span>
28+
@endif
29+
</div>
30+
</div>
31+
<div class="form-group row mb-10" id="re_send_code_hint" style="visibility: hidden">
32+
<div class="col-md-6 offset-md-4">
33+
<span class="text-muted">
34+
{{ __("Haven't received the code? Try ") }}
35+
</span>
36+
<a id="re_send_code_link" href="{{route('security.mfa', ['referer' => $referer])}}">
37+
{{ __('re-send auth code') }}
38+
</a>
39+
</div>
40+
</div>
41+
<div class="form-group row mb-0">
42+
<div class="col-md-6 offset-md-4">
43+
<button type="submit" class="btn btn-primary">
44+
{{ __('Submit') }}
45+
</button>
46+
</div>
47+
</div>
48+
49+
</form>
50+
</div>
51+
</div>
52+
</div>
53+
</div>
54+
</div>
55+
<script>
56+
setTimeout(function() {
57+
document.getElementById('re_send_code_hint').style.visibility = 'unset';
58+
document.getElementById("re_send_code_link").addEventListener("click", function(){
59+
document.getElementById('re_send_code_hint').style.visibility = 'hidden';
60+
});
61+
}, 10000);
62+
</script>
63+
@endsection

‎routes/web.php‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@
77
//Route::get('/scripts/{script}', 'ScriptController@show')->middleware(CheckResponseForModifications::class);
88
//Route::get('/styles/{style}', 'StyleController@show')->middleware(CheckResponseForModifications::class);
99

10-
Route::get('/mfa', function() {return 'hihihi';})->name('mfa');
11-
Route::post('/mfa', function() {return 'hihihi';});
12-
Route::post('/d', function() {return 'hihihi';});
10+
Route::get('/mfa', 'MFAController@getIndex')->name('mfa');
11+
Route::get('/mfa/form', 'MFAController@getForm')->name('mfa-form');
12+
Route::post('/mfa/form', 'MFAController@postForm');
13+

‎src/Http/Controllers/MFAController.php‎

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
<?php
2+
3+
namespace Sicaboy\LaravelSecurity\Http\Controllers;
4+
5+
use Illuminate\Routing\Controller;
6+
use Illuminate\Http\Request;
7+
use Illuminate\Support\Facades\Auth;
8+
use Illuminate\Support\Facades\Cache;
9+
use Illuminate\Support\Facades\Mail;
10+
use Illuminate\Support\Facades\Session;
11+
12+
class MFAController extends Controller
13+
{
14+
15+
const MFA_CODE_KEY = 'mfa_code';
16+
17+
public function getIndex(Request $request) {
18+
19+
// if (!Session::has('mfa_completed')) {
20+
$config = config('laravel-security.multi_factor_authentication');
21+
22+
$user = Auth::user();
23+
24+
$code = rand(100000, 999999);
25+
26+
$minutes = config('laravel-security.multi_factor_authentication.code_expire_after_minutes', 10);
27+
28+
Cache::put(self::MFA_CODE_KEY, $code, $minutes);
29+
30+
Mail::send($config['email']['template'], [
31+
'user' => $user,
32+
'code' => $code,
33+
'minutes' => $minutes,
34+
], function($message) use ($user, $config) {
35+
$message->to($user->email);
36+
$message->subject($config['email']['subject']);
37+
});
38+
39+
return redirect()->route('security.mfa-form', [
40+
'referer' => $request->get('referer')
41+
]);
42+
// }
43+
}
44+
45+
public function getForm(Request $request) {
46+
47+
$config = config('laravel-security.multi_factor_authentication');
48+
49+
$minutes = config('laravel-security.multi_factor_authentication.code_expire_after_minutes', 10);
50+
51+
return view('laravel-security::mfa.form', [
52+
'referer' => $request->get('referer'),
53+
'minutes' => $minutes,
54+
]);
55+
}
56+
57+
public function postForm(Request $request) {
58+
59+
$config = config('laravel-security.multi_factor_authentication');
60+
61+
$minutes = config('laravel-security.multi_factor_authentication.code_expire_after_minutes', 10);
62+
63+
$code = Cache::get(self::MFA_CODE_KEY);
64+
65+
if (!$code || trim($request->get('code')) != $code) {
66+
return redirect()->back()->withErrors([
67+
'code' => __('The code is not correct.')
68+
]);
69+
}
70+
71+
Session::put('mfa_completed', true);
72+
73+
return redirect()->to($request->get('referer', '/'));
74+
}
75+
76+
}

‎src/Http/Middleware/MFA.php‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
<?php
2+
3+
namespace Sicaboy\LaravelSecurity\Http\Middleware;
4+
5+
use Closure;
6+
use Illuminate\Routing\UrlGenerator;
7+
use Illuminate\Support\Facades\Auth;
8+
use Illuminate\Support\Facades\Session;
9+
10+
class MFA
11+
{
12+
13+
protected $generator;
14+
15+
16+
public function __construct(UrlGenerator $generator)
17+
{
18+
$this->generator = $generator;
19+
}
20+
21+
/**
22+
* Handle an incoming request.
23+
*
24+
* @param \Illuminate\Http\Request $request
25+
* @param \Closure $next
26+
* @return mixed
27+
*/
28+
public function handle($request, Closure $next)
29+
{
30+
if (config('laravel-security.multi_factor_authentication.enabled') !== true) {
31+
return $next($request);
32+
}
33+
34+
$user = Auth::user();
35+
if (!$user) {
36+
return redirect()->route('login');
37+
}
38+
39+
if (!Session::has('mfa_completed')) {
40+
return redirect()->route('security.mfa', [
41+
'referer' => $this->generator->previous()
42+
]);
43+
}
44+
return $next($request);
45+
}
46+
}

0 commit comments

Comments
 (0)