Skip to main content

Installation

Requirements​

  • PHP 8.4 or later
  • Laravel 13
  • Laravel Fortify 1.34.1 or later, with its registration and resetPasswords features enabled

Install the package​

composer require pushery/fortify-hardening-for-laravel

The service provider is registered through package discovery. From the next request on, Fortify's registration, reset-link and reset routes give the neutral answers described in Registration and Password reset. Each of the three can be switched off on its own in the configuration.

Send new accounts a verification mail​

The neutral registration tells every caller to check their inbox, and it signs nobody in. For that to be true for a new account as well, the new account has to receive a mail: implement MustVerifyEmail on your user model, and Laravel sends the verification link when the account is registered.

use Illuminate\Contracts\Auth\MustVerifyEmail;
use Illuminate\Foundation\Auth\User as Authenticatable;

class User extends Authenticatable implements MustVerifyEmail
{
    // ...
}

Without it a new account receives nothing, while the holder of a taken address receives the notice. The answer on the screen is still the same, but the person who registered is left waiting for a mail that never comes.

Show the answer on the sign-in page​

A registration from a web form is redirected to the route named login, with the answer flashed as status. Fortify's own sign-in views do the same after a password reset, so a sign-in page built for Fortify usually shows it already:

@if (session('status'))
    <p role="status">{{ session('status') }}</p>
@endif

A JSON request receives the answer in its body instead, with 202 Accepted.

Publish the configuration​

Every setting has a default and an environment variable, so publishing is optional. To change a setting that has no environment variable, publish the configuration file:

php artisan vendor:publish --tag=fortify-hardening-config
TagPublishes
fortify-hardeningthe configuration file and the translations, in one command
fortify-hardening-configconfig/fortify-hardening.php
fortify-hardening-langthe translations, to lang/vendor/fortify-hardening