Skip to content

[2.x] Add Password Confirmation as Standalone Feature #597

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
wants to merge 2 commits into
base: master
Choose a base branch
from

Conversation

alucic
Copy link

@alucic alucic commented Apr 27, 2025

This PR attempts to solve this issue #84

Currently, even with all features disabled in the fortify.php configuration file, the confirm password routes are still enabled.

This PR introduces breaking changes by making the confirm password routes disabled by default.
To enable them, you must either:

  1. Explicitly enable Features::passwordConfirmation() in the features array of your fortify.php file:

    'features' => [
        // ...
        Features::passwordConfirmation(),
        // ...
    ],
  2. Enable two-factor authentication with confirmPassword set to true:

    'features' => [
        // ...
        Features::twoFactorAuthentication([
            'confirmPassword' => true,
        ]),
        // ...
    ],

I'm not quite sure how to write tests for this. Updating the config during runtime doesn't work because routes register first

public function test_password_confirmation_routes_not_enabled_if_2fa_confirm_password_is_disabled()
{
    config(['fortify.features' => [
        Features::twoFactorAuthentication([
            'confirmPassword' => false,
        ]),
    ]]);

    $this->assertFalse(Route::has('password.confirm'));
    $this->assertFalse(Route::has('password.confirm.store'));
    $this->assertFalse(Route::has('password.confirmation'));
}

Tested locally 4 cases using php artisan route:list:

  1. With Features::passwordConfirmation() -> registers password routes
  2. With Features::twoFactorAuthentication(['confirmPassword' => true]) -> registers password routes
  3. Without Features::passwordConfirmation()
  4. With Features::twoFactorAuthentication(['confirmPassword' => false])

@alucic alucic marked this pull request as draft April 27, 2025 23:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant