pieceofcake2 / totp

v1.0.1 2026-10-16 08:35 UTC

Requires

• php: >=8.0
• composer/installers: ^1.0 || ^2.0
• pieceofcake2/cakephp: ^2.12
• pragmarx/google2fa: ^9.0

Requires (Dev)

• bacon/bacon-qr-code: ^2.0 || ^3.0
• phpstan/phpstan: ^2.1
• phpunit/phpunit: ^9.6
• pieceofcake2/app: ^2.2
• pieceofcake2/phpcs-cakephp2: ^1.1
• pieceofcake2/phpstan-cakephp2: ^1.0

Suggests

• bacon/bacon-qr-code: Required by TotpHelper::qrCode() to render the QR code (^2.0 || ^3.0)

Replaces

• ceeram/google-authenticate: *

MIT

• cakephp
• two-factor
• otp
• totp
• authenticate
• 2fa
• cakephp2
• google-authenticator

Published on Packagist.org on 2026-10-16 09:34 UTC

README

Two-factor authentication for the login of pieceofcake2/cakephp applications with time-based one-time passwords (TOTP, RFC 6238). The codes work with any authenticator app: Google Authenticator, Microsoft Authenticator, 1Password, Bitwarden and others.

• TotpComponent provides a two-step login (password, then the code on a second page) and generates secrets and verifies codes when a user sets up two-factor authentication
• TotpAuthenticate checks the username, password and code from one form (one-step login)
• TotpHelper shows the secret as a QR code (generated on the server) and as text
• Optional replay protection: each code can be used only once

Documentation

• Website: https://pieceofcake2.github.io/totp/ (日本語: https://pieceofcake2.github.io/totp/ja/)
• Markdown: docs/README.md (日本語: docs/ja/README.md) (for AI tools and offline reading)

It covers the configuration, the database columns, the login and setup pages, replay protection, security notes, the API reference and the migration from ceeram/google-authenticate.

The Markdown documentation is also included in the Composer package, in the plugin's directory: plugins/Totp/docs/README.md (the location depends on your installer-paths).

Requirements

• PHP 8.0+
• pieceofcake2/cakephp 2.12+
• bacon/bacon-qr-code 2.0+ (optional, for the QR code)

Installation

composer require pieceofcake2/totp
composer require bacon/bacon-qr-code

Load the plugin in config/bootstrap.php (legacy layout: app/Config/bootstrap.php):

CakePlugin::load('Totp');

See Installation for the installer-paths setting.

Usage

public $components = [
    'Auth' => ['authenticate' => ['Form' => ['fields' => ['username' => 'email']]]],
    'Totp.Totp',
];

public function login()
{
    if ($this->request->is('post')) {
        $result = $this->Totp->login();
        if ($result === TotpComponent::LOGGED_IN) {
            return $this->redirect($this->Auth->redirectUrl());
        }
        if ($result === TotpComponent::CODE_REQUIRED) {
            return $this->redirect(['action' => 'verify']);
        }
        $this->Flash->error(__('Invalid email or password.'));
    }
}

public function verify()
{
    if (!$this->Totp->hasPendingLogin()) {
        return $this->redirect(['action' => 'login']);
    }
    if ($this->request->is('post') && $this->Totp->verifyLogin($this->request->data('User.code'))) {
        return $this->redirect($this->Auth->redirectUrl());
    }
}

Users with a secret in the secret column enter the current code of their authenticator app on the second page. Users without a secret are logged in after the password. See Two-Step Login and Setting Up Two-Factor Authentication.

Contributing

See the contribution guidelines.

Origin

This package is a maintained fork of ceeram/GoogleAuthenticate (ceeram/google-authenticate on Packagist), originally by M. Ypes (Ceeram), renamed because the codes are standard TOTP codes. It is maintained for CakePHP 2 on modern PHP by pieceofcake2. Changes from the original are listed in the commit history since the fork.

License

Licensed under the MIT License. See LICENSE.