This is a collection of different techniques and measures to make your laravel app more secure.
Send email to [email protected] or [email protected]
You can install the package via composer:
composer require idez/nova-securityYou can publish and run the migrations with:
php artisan vendor:publish --tag="nova-security-migrations"
php artisan migrateYou can publish the config file with:
php artisan vendor:publish --tag="nova-security-config"You can publish the translations files with:
php artisan vendor:publish --tag="nova-security-translations"You can publish the views files with:
php artisan vendor:publish --tag="nova-security-views"This is the contents of the published config file:
return [
'brute_force' => [
'enabled' => true,
'max_attempts' => 3,
'ttl' => 3600,
'protected_field' => 'email',
],
'2fa' => [
/**
* Uses original config file for the 2fa.
*/
'ignore_override' => false,
/**
* Require 2FA for all users.
*/
'require_for_all' => false,
//... Other settings are the same as the google2fa-laravel configuration file.
]
];Brute force protection is a Middleware, which can be registered in your application's in App\Http\Kernel:
use Idez\NovaSecurity\Http\Middleware\NovaBruteForceProtection;
'middleware' => [
NovaBruteForceProtection::class
]Nothing prevents you from placing it elsewhere, such as App\Http\Kernel or config/nova.php
This package uses the pragmarx/google2fa-laravel package as a base.
Google 2fa or One Time Password is a Middleware, which can be registered in your application's in config/nova.php:
use Idez\NovaSecurity\Http\Middleware\NovaTwoFactor;
'middleware' => [
NovaTwoFactor::class
]In User Resource
\Idez\NovaSecurity\Actions\SetupUserTwoFactorAction::make()->onlyOnDetail()
->canSee(fn ($request) => $request instanceof ActionRequest || ($this->resource->id === auth()->user()->id && ! filled($this->resource->two_factor_secret)))
->canRun(fn ($request) => $request instanceof ActionRequest || ($this->resource->id === auth()->user()->id && ! filled($this->resource->two_factor_secret))),
\Idez\NovaSecurity\Actions\UnblockUserAction::make()
->onlyOnDetail()
->canSee(fn () => $request->user()->isSuperAdmin()),composer testPlease see CHANGELOG for more information on what has changed recently.
Please see CONTRIBUTING for details.
Please review our security policy on how to report security vulnerabilities.
The MIT License (MIT). Please see License File for more information.