componenta / auth-recovery-code

v2.0.0 2026-10-10 21:22 UTC

Requires

• php: ^8.4
• componenta/auth: ^3.0
• componenta/auth-session: ^1.0
• componenta/auth-session-http: ^2.0.1
• componenta/identity: ^1.0.1
• cycle/database: ^2.22
• psr/clock: ^1.0
• psr/http-factory: ^1.0
• psr/http-message: ^2.0
• psr/http-server-handler: ^1.0

Requires (Dev)

• componenta/clock: ^1.1.0
• nyholm/psr7: ^1.8
• phpstan/phpstan: ^2.1
• phpunit/phpunit: ^12.0

MIT

Published on Packagist.org on 2026-10-10 21:22 UTC

README

Single-use recovery codes for Componenta Auth 3.

Each recovery code contains 128 bits of CSPRNG entropy. Raw codes are returned only when a new batch is generated; the database stores only domain-separated SHA-256 hashes. Regenerating a batch invalidates all previous codes.

Recovery-code authentication is explicitly marked as recovery evidence and does not claim phishing resistance.

Version 2 compatibility

Version 2.0.0 requires componenta/auth-session-http ^2.0.1 and the CSRF v3 browser security model. Unsafe protected requests require valid Origin/Referer evidence and a valid CSRF token; an omitted origin must never be accepted by default. Auth's session-issuance contract remains unchanged.

See CHANGELOG.md for migration details and the verified security-admission tests.