PHPackages artisanpack-ui/security-auth - PHPackages - PHPackages [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register) 1. [Directory](/) 2. / 3. [Authentication & Authorization](/categories/authentication) 4. / 5. artisanpack-ui/security-auth ActiveLibrary[Authentication & Authorization](/categories/authentication) artisanpack-ui/security-auth ============================ Authentication security for Laravel — two-factor authentication (email/TOTP), password complexity and breach checking, account lockout, and session management. 1.0.1(1mo ago)071[5 issues](https://github.com/ArtisanPack-UI/security-auth/issues)1MITPHPPHP ^8.2CI passing Since May 19Pushed 1mo agoCompare [ Source](https://github.com/ArtisanPack-UI/security-auth)[ Packagist](https://packagist.org/packages/artisanpack-ui/security-auth)[ RSS](/packages/artisanpack-ui-security-auth/feed)WikiDiscussions main Synced 3w ago READMEChangelog (2)Dependencies (24)Versions (4)Used By (1) ArtisanPack UI — Security Auth ============================== [](#artisanpack-ui--security-auth) Authentication security for Laravel: two-factor authentication (email + TOTP), password complexity rules, HaveIBeenPwned breach checking, password history, account lockout, advanced session management, and step-up authentication. This package is part of the **ArtisanPack UI Security 2.0** split — the auth-focused features previously bundled inside `artisanpack-ui/security` (1.x) live here in 2.0+. Features -------- [](#features) - **Two-factor authentication** — `TwoFactor` Facade with `EmailProvider` (default) and Google2FA-backed TOTP. Trait `TwoFactorAuthenticatable` for User models. `TwoFactorCodeMailable` for email delivery. - **Password security** (`PasswordSecurityService`) — complexity rules, breach checking via HaveIBeenPwned, history enforcement, expiration tracking. Drop-in `Rule` classes: `PasswordComplexity`, `NotCompromised`, `PasswordHistoryRule`, `PasswordPolicy`. - **Account lockout** (`AccountLockoutManager`) — user-level and IP-level lockouts with configurable durations, failed-attempt tracking, lockout history. - **Advanced session management** (`AdvancedSessionManager`) — session bindings (IP / UA), concurrent session limits, session rotation, programmatic termination. - **Middleware** — `two-factor`, `password.policy`, `check.lockout`, `step-up`. - **Livewire components** — `PasswordStrengthMeter`, `AccountLockoutStatus`, `SessionManager`, `StepUpAuthenticationModal` with shipped Blade views (plain HTML + Tailwind, no `livewire-ui-components` dep). - **Eloquent models** — `AccountLockout`, `PasswordHistory`, `UserSession`. - **Migrations** — adds 2FA columns to `users`, plus tables for password history, user sessions, and account lockouts. - **Artisan command** — `security:lockout` (manage account lockouts: list, lock, unlock, clear). - **Events** — `AccountLocked`. Installation ------------ [](#installation) ``` composer require artisanpack-ui/security-auth php artisan migrate ``` > **Note:** the bundled migrations assume the standard Laravel `users` table exists. If you're adding this package to an app without one, run Laravel's default migrations first. (Optional) Publish the config: ``` php artisan vendor:publish --tag=security-auth-config ``` Quick start ----------- [](#quick-start) ### Enable 2FA on a User model [](#enable-2fa-on-a-user-model) ``` use ArtisanPackUI\SecurityAuth\TwoFactor\TwoFactorAuthenticatable; class User extends Authenticatable { use TwoFactorAuthenticatable; } ``` ``` use ArtisanPackUI\SecurityAuth\Facades\TwoFactor; // Generate secret + recovery codes (e.g. during 2FA setup) $user->generateTwoFactorSecret(); $user->generateRecoveryCodes(); // Verify a code (e.g. during login challenge) if ( TwoFactor::verify( $user, $request->input('code') ) ) { // success } ``` ### Validate a password with full policy [](#validate-a-password-with-full-policy) ``` use ArtisanPackUI\SecurityAuth\Rules\PasswordPolicy; $request->validate([ 'password' => ['required', 'confirmed', new PasswordPolicy], ]); ``` `PasswordPolicy` is a composite that runs complexity + breach check + history checks together. Use individual rules (`PasswordComplexity`, `NotCompromised`, `PasswordHistoryRule`) for finer control. ### Apply middleware [](#apply-middleware) ``` Route::middleware('two-factor')->group(function (): void { // routes requiring valid 2FA }); Route::middleware('check.lockout')->group(function (): void { // routes that should refuse locked accounts }); Route::middleware('step-up')->group(function (): void { // routes requiring a fresh credential challenge before access }); ``` ### Mount a Livewire component [](#mount-a-livewire-component) ``` ``` The four shipped Blade views render in plain HTML + Tailwind. Publish + override to customize. Documentation ------------- [](#documentation) - [Documentation home](docs/home.md) - [Getting started](docs/getting-started.md) - [Installation](docs/installation.md) - [Usage](docs/usage.md) - [Advanced](docs/advanced.md) - [FAQ](docs/faq.md) - [Troubleshooting](docs/troubleshooting.md) - [Changelog](CHANGELOG.md) Requirements ------------ [](#requirements) - PHP 8.2+ - Laravel 10 / 11 / 12 / 13 - `pragmarx/google2fa-laravel: ^2.3 | ^3.0` (pulled in automatically) for TOTP 2FA Sibling packages ---------------- [](#sibling-packages) PackageScope[`artisanpack-ui/security-full`](https://github.com/ArtisanPack-UI/security-full)Meta-package — pulls in the full security suite (all six packages below) in a single require[`artisanpack-ui/security`](https://github.com/ArtisanPack-UI/security)Core: input sanitization, escaping, CSP, security headers[`artisanpack-ui/security-advanced-auth`](https://github.com/ArtisanPack-UI/security-advanced-auth)WebAuthn, SSO, social login, biometric, device fingerprinting[`artisanpack-ui/rbac`](https://github.com/ArtisanPack-UI/rbac)Roles, permissions, Gate integration[`artisanpack-ui/secure-uploads`](https://github.com/ArtisanPack-UI/secure-uploads)File validation, malware scanning, signed-URL serving[`artisanpack-ui/security-analytics`](https://github.com/ArtisanPack-UI/security-analytics)Event logging, anomaly detection, SIEM, dashboards[`artisanpack-ui/compliance`](https://github.com/ArtisanPack-UI/compliance)GDPR / CCPA / LGPD compliance toolsLicense ------- [](#license) MIT — see [LICENSE](LICENSE). Contributing ------------ [](#contributing) Please read the [contributing guidelines](CONTRIBUTING.md) before opening an issue or PR. ### Health Score 42 — FairBetter than 88% of packages Maintenance92 Actively maintained with recent releases Popularity12 Limited adoption so far Community8 Small or concentrated contributor base Maturity48 Maturing project, gaining track record Bus Factor1 Top contributor holds 100% of commits — single point of failure How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window. **Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores. **Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement. **Maturity (30%)** — Project age, version count, PHP version support, and release stability. ### Release Activity Cadence Every ~26 days Total 2 Last Release 40d ago ### Community Maintainers ![](https://www.gravatar.com/avatar/ba2a2c40c9a93470595cd10701d2291434f3a7db61862d9700a9e69e31608c6c?d=identicon)[JacobMartellaWebDesign](/maintainers/JacobMartellaWebDesign) --- Top Contributors [![ViewFromTheBox](https://avatars.githubusercontent.com/u/8247489?v=4)](https://github.com/ViewFromTheBox "ViewFromTheBox (25 commits)") --- Tags laravelsecurityAuthenticationpassword2fasessiontwo-factorlockout ### Code Quality TestsPest Code StyleLaravel Pint ### Embed Badge ![Health badge](/badges/artisanpack-ui-security-auth/health.svg) ``` [![Health](https://phpackages.com/badges/artisanpack-ui-security-auth/health.svg)](https://phpackages.com/packages/artisanpack-ui-security-auth) ``` ### Alternatives [laragear/two-factor On-premises 2FA Authentication for out-of-the-box. 341942.8k19](/packages/laragear-two-factor)[alajusticia/laravel-logins Session management in Laravel apps, user notifications on new access, support for multiple separate remember tokens, IP geolocation, User-Agent parser 2014.5k](/packages/alajusticia-laravel-logins)[sicaboy/laravel-mfa A Laravel package of Multi-factor Authentication (MFA/2FA) with a middleware. 101.3k](/packages/sicaboy-laravel-mfa) PHPackages © 2026 [Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)