README

Authentication for Laravel: login, sign-up, password reset, e-mail verification, two-factor authentication and social login, with a Livewire or an Inertia front-end.

Installation

composer require datalogix/laravel-guardian

Then install the front-end you use, and Socialite if you enable social login.

Livewire front-end (default):

composer require livewire/livewire

Inertia front-end:

composer require inertiajs/inertia-laravel

Social login:

composer require laravel/socialite

The bundled Livewire views use datalogix/tallkit. Install it, or publish the views and write your own.

Features

🔑 Login & logout with remember-me and rate limiting
📝 Sign-up by e-mail, username, CPF or CNPJ
🔁 Password reset & confirmation
✉️ E-mail verification
🔒 Two-factor authentication: authenticator app, e-mail or SMS, recovery codes and trusted devices
🌐 Social login with any Laravel Socialite provider
🏰 Multiple fortresses: independent flows per guard, domain or path
🇧🇷 CPF and CNPJ validation rules

Quick start

use Datalogix\Guardian\Fortress;
use Datalogix\Guardian\Guardian;

public function boot(): void
{
    Guardian::registerFortress(Fortress::make()->basic());
}

Run the migrations (only those of the features you enable):

php artisan migrate

Presets

Preset	Includes
`basic()`	Login, logout, password reset and confirmation
`admin()`	`basic()` under `/admin`
`product()`	`basic()` with sign-up and e-mail verification

Enable more on top of a preset:

Fortress::make()->product()->twoFactor()->oauth(providers: ['google']);

Several fortresses can run side by side, each with its own path() or domain():

Guardian::registerFortress(Fortress::make()->basic());
Guardian::registerFortress(Fortress::make()->admin());

Front-ends

Livewire is the default. To change the pages of a fortress, point it to a folder of views; pages missing from it keep the bundled ones:

Fortress::make()->livewire(views: 'admin.auth')->admin();

Inertia ships default pages for Vue and React. Add your HandleInertiaRequests middleware and publish the pages:

Fortress::make()->inertia()->product()->middleware([HandleInertiaRequests::class]);

php artisan vendor:publish --tag=guardian-inertia-vue    # or guardian-inertia-react

Configuration

Most options are set per fortress (twoFactor(), oauth(), signUp()...). The global ones are in the config file:

php artisan vendor:publish --tag=guardian-config

Translations:

php artisan vendor:publish --tag=guardian-lang

Livewire views:

php artisan vendor:publish --tag=guardian-views

Migrations (then set guardian.migrations to false):

php artisan vendor:publish --tag=guardian-migrations

In production

Trust your proxies. Rate limits count per IP: behind a load balancer or Cloudflare, configure trustProxies() in bootstrap/app.php, or every visitor shares the same limit.
Use a shared cache store (redis, database...) for guardian.cache_store, so the rate limits hold across servers.
Social login only creates accounts for verified e-mails. Socialite's GitHub driver sends no verified claim, so tell Guardian with emailVerifiedUsing:
```
->oauth(providers: ['github'], emailVerifiedUsing: fn ($user, array $raw, string $provider) => $provider === 'github')
```
Laravel Fortify uses the same two-factor column names with another format. If you use it, set other names in guardian.columns.

datalogix / laravel-guardian

Package info

Security

Fund package maintenance!

Statistics