Downloads
Stars
Version
This package can be used to enhance the user security of Laravel projects.
Requirements:
To get the latest version of Laravel Security, simply run:
composer require sicaboy/laravel-security
Then do vendor publish:
php artisan vendor:publish --provider="Sicaboy\LaravelSecurity\LaravelSecurityServiceProvider"
After publishing, you can modify templates and config in:
app/config/laravel-security.php
resources/views/vendor/laravel-security/
resources/lang/en/laravel-security.php
If you're on Laravel < 5.5, you'll need to register the service provider. Open up config/app.php
and add the following to the providers
array:
Siaboy\LaravelSecurity\LaravelSecurityServiceProvider::class,
Verify the user-provided password is not one of the top 10,000 worst passwords as analyzed by a respectable IT security analyst. Read about all here, here(wired) or here(telegram)
NotCommonPassword - Avoid user to use a common used password
NotAUsedPassword - Avoid user to use a password which has been used before
// Add rule instance to the field validation rules list
public function rules()
{
return [
'password_field' => [
'required',
'confirmed',
'min:8',
'regex:/[a-z]/', // must contain at least one lowercase letter
'regex:/[A-Z]/', // must contain at least one uppercase letter
'regex:/[0-9]/', // must contain at least one digit
//...
new \Sicaboy\LaravelSecurity\Rules\NotCommonPassword(),
new \Sicaboy\LaravelSecurity\Rules\NotAUsedPassword($user),
],
];
}
// Also you need to call event, examples in the next section
User login and register events have been automatically traced. While there is an extra event you should add to call explicitly.
// Call on user password change
event(new \Illuminate\Auth\Events\PasswordReset($user));
// If you are using custom login, register and reset password actions which are not the Laravel built-in ones, you will need to call event in your function accordingly.
event(new \Illuminate\Auth\Events\Login($user));
event(new \Illuminate\Auth\Events\Registered($user));
event(new \Illuminate\Auth\Events\PasswordReset($user));
enabled
to true
in config/laravel-security.php
as below:...
'password_policy' => [
// Delete accounts with days of no activity
'auto_delete_inactive_accounts' => [
'enabled' => true,
...
],
// Lock out accounts with days of no activity
'auto_lockout_inactive_accounts' => [
'enabled' => true,
...
],
]
...
Route::middleware(['security'])->group(function () {
...
});
User
objects, for example a traditional App\User
and a customize admin user, you can write middleware this way:Route::middleware(['security:admin'])->group(function () {
...
});
config/laravel-security.php
return [
'default' => [
...
],
'group'
'admin' => [ // Example, when using middleware 'security:admin'. Attributes not mentioned will be inherit from `default` above
...
],
'other_name' => [ // Middleware 'security:other_name'
...
]
],
Force change password every x days
you need to set enabled
to true
and change_password_url
in config/laravel-security.php
as below:...
'password_policy' => [
...
// Force change password every x days
'force_change_password' => [
'enabled' => true,
'days_after_last_change' => 90, // every 90 days
'change_password_url' => '/user/change-password', // Change My Password page URL
],
...
]
...
app/Console/Kernel.php
of your application. Implement to one instance if using web server clusters
protected function schedule(Schedule $schedule)
{
$schedule->command(\Sicaboy\LaravelSecurity\Console\Commands\DeleteInactiveAccounts::class)
->hourly();
$schedule->command(\Sicaboy\LaravelSecurity\Console\Commands\LockoutInactiveAccounts::class)
->hourly();
...
}
* * * * * cd /path-to-your-project && php artisan schedule:run >> /dev/null 2>&1
This feature has been moved to sicaboy/laravel-mfa
Ability to split extended_security
table to multiple tables. or other methods to support websites with huge user mount.
Add cron job to remove too old password records to avoid heavy table.
Please see CHANGELOG for more information on what has changed recently.
Please feel free to fork this package and contribute by submitting a pull request to enhance the functionalities.
The MIT License (MIT). Please see License File for more information.