Configuration

Every setting has a default, so the package works without a published configuration file. To change a setting that has no environment variable, publish the file:

php artisan vendor:publish --tag=fortify-hardening-config

A published file keeps receiving settings that later releases add, because the package merges its defaults under it key by key. A list you set, such as notice_channels, stands as you wrote it.

Settings

Key	Environment variable	Default	What it does
password_reset_link.enabled	FORTIFY_HARDENING_PASSWORD_RESET_LINK	true	answers every reset-link request like a sent link
password_reset.enabled	FORTIFY_HARDENING_PASSWORD_RESET	true	answers every failed reset like a wrong token
registration.enabled	FORTIFY_HARDENING_REGISTRATION	true	puts the neutral registration on Fortify's route
registration.request		RegistrationRequest::class	the form request that validates a registration
registration.redirect_route		'login'	where a web registration is redirected to
registration.sign_in_route		'login'	where the notice's button leads
registration.notification		AccountAlreadyExistsNotification::class	the notice the holder of a taken address receives
registration.notice_channels		['mail']	the channels the notice goes out on
registration.max_mails_per_hour	FORTIFY_HARDENING_MAX_MAILS_PER_HOUR	1	how many mails the registration may send to one address within an hour
timebox.microseconds	FORTIFY_HARDENING_TIMEBOX_MICROSECONDS	1000000	the minimum duration of a failed sign-in, a reset-link request and a failed reset

A value the package cannot use falls back to its default: a mail budget below one is one, and a negative minimum duration is the default. A minimum of 0 leaves Laravel's own in place, and a value your application sets in auth.timebox_duration always wins over the package's. See Timing for what the minimum covers.

Each of the three enabled switches is off for false, 0, no, off or an empty value, in any case and with spaces around it. Any other value, and a variable that is not set, keeps the section on.

Switching off the registration takes the package's controller off Fortify's route. The registrar stays available to a controller of your own.

Translations

The answer to a registration and the notice are written in German, English, Spanish, French, Italian, Dutch and Portuguese, in the application's locale. The answers on the password routes are Laravel's own and come from your application's passwords translations.

Key	English
fortify-hardening::messages.registration.accepted	We have sent an email to that address. Please check your inbox to continue.
fortify-hardening::messages.notice.subject	Someone tried to register with your email address
fortify-hardening::messages.notice.attempt	Someone tried to create an account with this email address, but you already have one.
fortify-hardening::messages.notice.action	Sign in
fortify-hardening::messages.notice.next	If that was you and you have forgotten your password, you can reset it from the sign-in page. If it was not you, there is nothing you need to do.

To change a text, or to add a language, publish the translations and edit them in lang/vendor/fortify-hardening:

php artisan vendor:publish --tag=fortify-hardening-lang