Authentication Configuration

Relevant source files

The following files were used as context for generating this wiki page:

• config/auth.php
• database/migrations/0001_01_01_000000_create_users_table.php
• config/session.php
• resources/views/welcome.blade.php
• phpunit.xml
• bootstrap/app.php

Introduction

Authentication in this Laravel project is managed through a flexible system of guards and providers. This architecture allows the application to define how users are authenticated (guards) and how they are retrieved from storage (providers). The primary goal is to provide a secure and customizable mechanism for managing user identity and access control across the web interface and potentially other entry points.

The system integrates directly with the database schema for user management, session persistence, and password security. By default, it utilizes an Eloquent-based provider and session-based guards to maintain user state across HTTP requests.

Sources: config/auth.php:3-43, bootstrap/app.php:7-14

Core Components

The authentication system is built upon three primary pillars defined in the configuration: Defaults, Guards, and Providers.

Authentication Defaults

The configuration specifies a default "guard" and "broker" for password resets. These defaults are used when no specific guard is requested during an authentication check.

Option	Environment Variable	Default Value	Description
guard	AUTH_GUARD	web	The default authentication guard.
passwords	AUTH_PASSWORD_BROKER	users	The default password reset broker.

Sources: config/auth.php:15-20

Authentication Guards

Guards define how the system authenticates users for each request. The project currently implements a web guard that utilizes the session driver. This driver maintains the user's state by storing identified data in the session storage.

User Providers

Providers define how users are retrieved from the persistent storage. The default configuration uses the eloquent driver, which interacts with the User model. An alternative database driver is also supported, which interacts directly with a database table.

Provider	Driver	Model / Table
users (Default)	eloquent	App\Models\User::class
users (Alt)	database	users table

Sources: config/auth.php:59-73

Data Schema and Persistence

Authentication relies on specific database structures to manage user data, password reset tokens, and active sessions.

Database Tables

The authentication migration defines three critical tables:

1. users: Stores core identity information including name, email, and hashed password.
2. password_reset_tokens: Manages unique tokens used for identity verification during password recovery.
3. sessions: Persists user session data, allowing users to remain logged in across different requests.

Security and Timeouts

The system includes built-in protections for password management and session security.

Password Reset Logic

Password resets are configured with specific expiration and throttling settings to prevent abuse. Tokens are valid for 60 minutes, and users are limited to generating one token every 60 seconds.

Sources: config/auth.php:94-99

Confirmation and Lifetimes

• Password Timeout: Users must re-confirm their password if they attempt to access sensitive areas after 10,800 seconds (3 hours) since their last confirmation.
• Session Lifetime: Sessions are configured to last for 120 minutes by default.

Feature	Config Path	Default
Password Re-confirm	auth.password_timeout	10800 seconds
Session Duration	session.lifetime	120 minutes

Sources: config/auth.php:112, config/session.php:34

Integration in UI

The frontend uses Blade directives to conditionally display content based on the user's authentication status. The welcome.blade.php file demonstrates the usage of @auth and @else tags to show either a "Dashboard" link or "Log in/Register" links.

@if (Route::has('login'))
    <nav class="flex items-center justify-end gap-4">
        @auth
            <a href="{{ url('/dashboard') }}">Dashboard</a>
        @else
            <a href="{{ route('login') }}">Log in</a>
            @if (Route::has('register'))
                <a href="{{ route('register') }}">Register</a>
            @endif
        @endauth
    </nav>
@endif

Sources: resources/views/welcome.blade.php:21-47

Testing Configuration

During testing, the authentication system is typically modified to use faster or more volatile drivers to ensure test isolation and performance.

Component	Test Environment Value	Source
Bcrypt Rounds	4	phpunit.xml:34
Session Driver	array	phpunit.xml:42
DB Database	:memory:	phpunit.xml:38

Sources: phpunit.xml:34-42

Summary

The Authentication Configuration provides a robust framework for managing identities. By decoupling the authentication mechanism (guards) from the storage mechanism (providers), the system maintains flexibility. Security is further enhanced through configurable timeouts for password confirmations and strict throttling on password reset attempts.