Reauthenticate
![Software License][ico-license]
![Coverage Status][ico-scrutinizer]
![Total Downloads][ico-downloads], (*1)
For pages that contain more sensitive operations, sometimes you wish to have the user reauthenticate themselves. This simple package provides the tools you need to quickly implement this functionality on your website., (*2)
Install
Via Composer, (*3)
``` bash
$ composer require browner12/reauthenticate, (*4)
## Setup
Add the service provider to the providers array in `config/app.php`.
``` php
'providers' => [
browner12\reauthenticate\ReauthenticateServiceProvider::class,
];
If you are using Laravel's automatic package discovery, you can skip this step., (*5)
Publishing
While we provide sensible defaults, if you would like to customize this package simply publish the config file with the following command., (*6)
``` php
php artisan vendor:publish --provider="browner12\reauthenticate\ReauthenticateServiceProvider", (*7)
## Wiring
Let's start by adding our new middleware to `App\Http\Kernel.php`.
```php
protected $routeMiddleware = [
'auth' => \Illuminate\Auth\Middleware\Authenticate::class,
'auth.basic' => \Illuminate\Auth\Middleware\AuthenticateWithBasicAuth::class,
'bindings' => \Illuminate\Routing\Middleware\SubstituteBindings::class,
'can' => \Illuminate\Auth\Middleware\Authorize::class,
'guest' => \App\Http\Middleware\RedirectIfAuthenticated::class,
'throttle' => \Illuminate\Routing\Middleware\ThrottleRequests::class,
'reauthenticate' => \browner12\reauthenticate\Reauthenticate::class,
];
We will need 2 routes for our reauthentication. One to show the form to enter a password, and another to process the input., (*8)
Route::get('reauthenticate', 'ReauthenticateController@reauthenticate')->name('reauthenticate');
Route::post('reauthenticate', 'ReauthenticateController@processReauthenticate')->name('reauthenticate.process');
Now let's make the associated controller:, (*9)
php artisan make:controller ReauthenticateController
This package offers a trait to use in your controller. This pattern gives you the flexibility to customize the controllers as you need, while also controlling the pieces that are important for the normal package operation., (*10)
The trait offers 2 methods:, (*11)
-
checkReauthenticationPassword() - Checks the entered password against the known hash, and returns the requested URL if successful. Returns false on failure.
-
resetReauthenticationTimer() - Stores the current time in the session as the last successful authentication.
Now we will use this trait in our controller., (*12)
namespace App\Http\Controllers;
use browner12\reauthenticate\Concerns\Reauthenticates;
use Illuminate\Http\Request;
class ReauthenticateController extends Controller
{
use Reauthenticates;
/**
* @return \Illuminate\Contracts\View\Factory|\Illuminate\View\View
*/
public function reauthenticate()
{
//load view
return view('main/auth/reauthenticate');
}
/**
* @param \Illuminate\Http\Request $request
* @return \Illuminate\Http\RedirectResponse
*/
public function processReauthenticate(Request $request)
{
//good password
if ($url = $this->checkReauthenticationPassword($request->get('password'), $request->user()->password)){
return redirect()->to($url);
}
//send back
return back();
}
}
We do not require your view to be formatted in any way, or name your inputs anything specific. In the example above, the input is named 'password', and we are pulling the current password hash off of the logged in user., (*13)
If you would like to reset the timer in any of your other controllers, for example when the user initially logs in, you can also use the resetAuthorizationTimer() method on this trait., (*14)
Usage
Using the reauthentication feature is incredibly easy. Simply add the middleware to either your routes:, (*15)
Route::get('users', 'UserController')->middleware('reauthenticate');
or your controllers:, (*16)
class UserController extends Controller
{
/**
* constructor
*/
public function __construct()
{
//parent
parent::__construct();
//middleware
$this->middleware('auth');
//reauthenticate
$this->middleware('reauthenticate')->only(['index']);
}
}
Limitations
Currently this feature only works on GET requests. The reason for this is because we cannot redirect to a POST route. I do have a solution in mind that uses a dummy page with a form that automatically submits, but I am holding off to see what the interest for it is first., (*17)
Change log
Please see CHANGELOG for more information on what has changed recently., (*18)
Contributing
Please see CONTRIBUTING and CODE_OF_CONDUCT for details., (*19)
Security
If you discover any security related issues, please email browner12@gmail.com instead of using the issue tracker., (*20)
Credits
License
The MIT License (MIT). Please see License File for more information., (*21)
Wallogit.com
