Fortify Hardening for Laravel
Laravel Fortify tells anyone who asks whether an email address has an account. Its registration form refuses a taken address with "The email has already been taken.", its reset-link form answers an unknown address with "We can't find a user with that email address.", and a password reset names the same difference. Each of those answers is enough to check a list of addresses against your application, one request at a time.
This package closes all three, and the difference in time behind them.
composer require pushery/fortify-hardening-for-laravel
The package is on Packagist, and the source and the issue tracker live at github.com/pushery/fortify-hardening-for-laravel.
What changes
| Where | Fortify on its own | With the package |
|---|---|---|
| Registration | a taken address is refused, a free one is signed in | both get "check your inbox", nobody is signed in, the holder of a taken address gets a notice |
| Reset link | an unknown address is refused, an address that asked a minute ago is told to wait | every request reads like a link that was sent |
| Password reset | an unknown address and a wrong token give different errors | every failure reads like a wrong token |
| Timing | a taken address answers in a fraction of the time a free one takes, and a known address takes longer on the password routes | both answers take the same time |
The package keeps Fortify's routes, its controllers for everything else and your own actions. It puts its answers in place of Fortify's through the container, so there is no route to register and no view to publish.
Pages
- Installation: what to install, and the two things your application has to provide.
- Registration: the neutral registration on Fortify's route, the notice to the holder, and the same flow from a controller of your own.
- Password reset: the reset-link request and the reset itself.
- Timing: why a neutral text is not enough, and how both answers come to take the same time.
- Testing your application: the assertion the package ships, to prove the property in your own suite.
- Configuration: every setting, its environment variable and its default, and the translations.
- What it does not cover: the routes and the guarantees left to your application, and what to do about each.