[2.x] Add Password Confirmation as Standalone Feature

UPGRADE.md

@@ -2,6 +2,36 @@
 
 Future upgrade notes will be placed here.
 
+---
+
+## Upgrading to 2.x from 1.x
+
+### Confirm Password Feature Disabled by Default
+
+> **If you're using two-factor authentication with `confirmPassword`, no changes are needed; otherwise, enable password confirmation manually.**
+
+If your application is already using two-factor authentication with `confirmPassword` enabled, no changes are required — everything should continue to work as before:
+
+```php
+'features' => [
+    // ...
+    Features::twoFactorAuthentication([
+        'confirmPassword' => true,
+    ]),
+    // ...
+],
+```
+
+If your application is **not** using two-factor authentication but **is** using `password.confirm` routes, you will need to enable the password confirmation feature in your `fortify.php` configuration file by adding the following line to the `features` array:
+
+```php
+'features' => [
+    // ...
+    Features::passwordConfirmation(),
+    // ...
+],
+```
+
 ## Upgrading To 1.7.3 From 1.x
 
 ### Two Factor Brute Force Attack Security Fix

config/fortify.php

@@ -64,6 +64,7 @@
         Features::emailVerification(),
         Features::updateProfileInformation(),
         Features::updatePasswords(),
+        Features::passwordConfirmation(),
         Features::twoFactorAuthentication(),
     ],
 ];

routes/routes.php

@@ -111,19 +111,21 @@
     }
 
     // Password Confirmation...
-    if ($enableViews) {
-        Route::get(RoutePath::for('password.confirm', '/user/confirm-password'), [ConfirmablePasswordController::class, 'show'])
-            ->middleware([config('fortify.auth_middleware', 'auth').':'.config('fortify.guard')])
-            ->name('password.confirm');
-    }
+    if (Features::enabled(Features::passwordConfirmation()) || Features::optionEnabled(Features::twoFactorAuthentication(), 'confirmPassword')) {
+        if ($enableViews) {
+            Route::get(RoutePath::for('password.confirm', '/user/confirm-password'), [ConfirmablePasswordController::class, 'show'])
+                ->middleware([config('fortify.auth_middleware', 'auth').':'.config('fortify.guard')])
+                ->name('password.confirm');
+        }
 
-    Route::get(RoutePath::for('password.confirmation', '/user/confirmed-password-status'), [ConfirmedPasswordStatusController::class, 'show'])
-        ->middleware([config('fortify.auth_middleware', 'auth').':'.config('fortify.guard')])
-        ->name('password.confirmation');
+        Route::get(RoutePath::for('password.confirmation', '/user/confirmed-password-status'), [ConfirmedPasswordStatusController::class, 'show'])
+            ->middleware([config('fortify.auth_middleware', 'auth').':'.config('fortify.guard')])
+            ->name('password.confirmation');
 
-    Route::post(RoutePath::for('password.confirm', '/user/confirm-password'), [ConfirmablePasswordController::class, 'store'])
-        ->middleware([config('fortify.auth_middleware', 'auth').':'.config('fortify.guard')])
-        ->name('password.confirm.store');
+        Route::post(RoutePath::for('password.confirm', '/user/confirm-password'), [ConfirmablePasswordController::class, 'store'])
+            ->middleware([config('fortify.auth_middleware', 'auth').':'.config('fortify.guard')])
+            ->name('password.confirm.store');
+    }
 
     // Two Factor Authentication...
     if (Features::enabled(Features::twoFactorAuthentication())) {

src/Features.php

@@ -91,6 +91,16 @@ public static function resetPasswords()
         return 'reset-passwords';
     }
 
+    /**
+     * Enable the password confirmation feature.
+     *
+     * @return string
+     */
+    public static function passwordConfirmation()
+    {
+        return 'password-confirmation';
+    }
+
     /**
      * Enable the email verification feature.
      *

stubs/fortify.php

@@ -149,6 +149,7 @@
         // Features::emailVerification(),
         Features::updateProfileInformation(),
         Features::updatePasswords(),
+        Features::passwordConfirmation(),
         Features::twoFactorAuthentication([
             'confirm' => true,
             'confirmPassword' => true,