darkghosthunter / passless
Passless is a password-less authentication guard driver for Laravel 5.8
Requires
- php: ^7.1.3
- illuminate/auth: 5.8.*
- illuminate/config: 5.8.*
- illuminate/cookie: 5.8.*
- illuminate/events: 5.8.*
- illuminate/http: 5.8.*
- illuminate/notifications: 5.8.*
- illuminate/session: 5.8.*
- illuminate/support: 5.8.*
Requires (Dev)
- orchestra/testbench: 3.8.*
This package is auto-updated.
Last update: 2020-04-06 03:06:04 UTC
README
Passless
Passwordless Authentication Driver for Laravel. Just add water.
Requirements
- Laravel 6 or Laravel 7
Check older releases for older Laravel versions.
What includes
- Passless Authentication Guard Driver
- Passless Login Controller
LoginAuthentication
Notification- Little magic
Install
Just fire up Composer and require it into your Laravel project:
composer require darkghosthunter/passless
How it works
This guards extends the default SessionGuard
and only overrides the authentication method to not check the password, only if the user exists by the given credentials (email or whatever keys you set in your form or controller).
To register your users without a password, allow in your migration files the password
string to be nullable()
. Alternatively, pass an empty string on registration.
Schema::create('users', function (Blueprint $table) { // ... $table->string('password')->nullable(); $table->rememberToken(); $table->timestamps(); });
In your login form, you can discard the password input and leave only the email or username.
<form action="{{ route('auth.login') }}" method="post"> @csrf <input name="email" type="email" placeholder="Put your email"> <button type="Submit"> </form
This will allow users to login through an email (if they're are registered), and throw an auth error if it doesn't.
When the user signs-in, an email is dispatched. The Email contains a temporarily signed URL which directs the user to the Passless LoginController
, which will login the user into your application.
How to use
Passless is easy to integrate into your application, but before start using it you should change some strings in your configuration to point your app to use this package.
Don't worry, it doesn't breaks your Laravel installation in any way.
1) Add the Guard Driver
Go into your config/auth.php
and add passless
as the driver for your guard.
'guards' => [
'web' => [
'driver' => 'passless',
'provider' => 'users',
],
'api' => [
'driver' => 'token',
'provider' => 'users',
],
],
Remember to set the correct guard (in this case,
web
) to use the passless driver in your Login and Register Controllers.
2) Disable the password validation
In your login form you shouldn't have the password
input. If you're using the default Auth\LoginController
class, you should override the validateLogin()
method and disable the password validation.
/** * Validate the user login request. * * @param \Illuminate\Http\Request $request * @return void */ protected function validateLogin(Request $request) { $this->validate($request, [ $this->username() => 'required' // 'password' => 'required ]); }
3) Add the proper Login response
Since the user won't be logged in immediately into your application when your credentials are validated, you should return a view which Notifies the user to check his email with a message or alert.
While you are free to use any View to inform the user, you can just simply add a flash notification in your Login route, along with the proper markup to retrieve and show the notification in the view.
If you're using the default controller, add or replace this code:
/** * The user has been authenticated. * * @param \Illuminate\Http\Request $request * @param mixed $user * @return \Illuminate\Http\Response */ protected function authenticated(Request $request, $user) { $request->flashOnly(['email']); $request->session()->flash('success', 'Check your email to log in!'); return response()->view('auth.login'); }
Since there is no password check in the login form, you may want to add a throttler middleware like
throttle:60,3
to your Login route to avoid mail asphyxiation.
Configuration
For fine tuning, publish the Passless configuration:
php artisan vendor:publish --provider="DarkGhostHunter\Passless\PasslessServiceProvider"
You should definitively edit this config file if:
- You're using a custom authentication controllers.
- You're using additional middleware across your routes.
- Need a different Login for Passless.
- Need a better Notification for your Login Email.
The contents of the config file are self-explanatory, so check the comments over each setting key.
License
This package is licenced by the MIT License.