How to Make a Passwordless Login System In Laravel

Рет қаралды 9,266

7 ай бұрын

In this Larabit, I'll show you how to build a passwordless authentication system from scratch. We'll start with Laravel's Breeze scaffolding, and then we'll perform the necessary adjustments to make it passwordless. Specifically, we'll leverage temporary signed URLs to make the entire process a cinch!
Watch thousands of videos, track your progress, and participate in a massive Laravel community at Laracasts.com.
Laracasts: laracasts.com
Laracasts Twitter: / laracasts
Jeffrey Way Twitter: / jeffrey_way

Пікірлер: 38

@christogonusobasi7882 6 ай бұрын

I like the fact that you show how you debug in real life. It gives me confidence that I am not a dull lad. When I watch error-free screencasts, I feel like there is a stage in programming when you are not supposed to ever have an error in your code! Meanwhile, I got Laracast's lifetime account so that I can just copy and use straight out of the box. If you have done it, why should I repeat 🤭🤭

@andresgutgon 7 ай бұрын

So easy. I'm in love with Laravel

@vinit095 7 ай бұрын

At least you are also victim of random problem occuring when making a video and debugging on point. Not like other people who just doing copy paste from their 2nd screen 😅. ❤

@aogunnaike 7 ай бұрын

Thanks for this 🙏

@WhatsMyGame-hc3pr 7 ай бұрын

Great teaching as always. One quick note: I would also give positive feedback to the user in case the provided e-mail address is not in the database. This prevents guessing website users.

@DeveloperChris 7 ай бұрын

Bad option. Bad actors continue to submit email addresses until they find as many as they need. Feedback makes it easy for them.

@codesmiles_ 7 ай бұрын

I'll get to know this stuff soon

@enrica6616 7 ай бұрын

Thank you for this great explanation. Passwordless would be better with passkey or Fido2. Is it possible to extend your example app with passkeys?

@borakayalar 7 ай бұрын

This approch can be used for admins, sometimes admin wants to see user screen so if it has implemented for only admin users than admin can check the user screen. And Admin does need to know user's password. It is very usefull for me. It is exacly what I want. Many thaks.

@iWhacko 6 ай бұрын

you have the "impersonate feature" in a couple of laravel plugins. don't use this method. it's insecure

@borakayalar 6 ай бұрын

@@iWhacko you are right! Maybe we can add another session guard and admin can login with this guarded new session. If I am wrong, sorry coz, I'm new into laravel :) still I am trying to learn detailed concept for laravel. There are many tutorails about it but anyone can not tell detailed approch , lifecycles, logic etc.... Such as service containers, providers, configs very important. When use them, you can figure it out very easyly to diffucult process. And kernel logic very important. No one does not dive to into kernel.

@bulent2435 7 ай бұрын

perfect.

@wakcodes 7 ай бұрын

Your videos are awesome; however, I really like the way you set up your editor. Can you please share how I can set up mine like yours?

@trippthree8842 7 ай бұрын

Yes please!

@arif-khan 7 ай бұрын

A question: When you hit the url with user id 2, laravel is throwing "404 | Not Found", probably because user does not exists in the database. I may be wrong, but it should throw "403 | Invalid Url" or "403 | Invalid Signature" whatever it is. I guess, Laravel is allowing the URL to be hit the method "loginWithToken" with user ID 2. Please correct me If I am wrong. Always enjoy Laracasts' Video. Keep Posting.

@richard_keep 7 ай бұрын

Just tested manually and Jeffrey is right. I have a user with ID 2 and when I manually edit the URL I get the 403 INVALID SIGNATURE response.

@arif-khan 7 ай бұрын

@@richard_keep noted

@MarkSnape 7 ай бұрын

This is because route model binding is performed before the validation of the signed route. So when there is no record 2, you get a 404, but if there is a record with ID of 2 then the route model binding works and the invalid signature occurs.

@DeveloperChris 7 ай бұрын

While simple security like this may seem a positive step and make life easier for your users. It's not. What if the user no longer has access to the email address? How do they log in to change it? This system can also be used in a password reset attack if the implementation Isn't protected against it. Some email systems can take quite a while before the email is delivered. For example my ISP delays emails by up to 10 min. Which means I have to wait 10 minutes before I can log in.

@devKazuto 7 ай бұрын

Or not at all if the URL is valid for 5 minutes but the mail takes longer to arrive. Or your mail server is down and thus can't login. Password has always been the standard and will always be. Even Yubikey will probably never see widespread adoption, cause you'd have to carry it with you everywhere you go and if you lose it you can't just reset your password.

@nelsonmelecio 7 ай бұрын

I also do ray() most in my development and ray does encodes html entities in the URL most of the times..

@jontyrodrigues 7 ай бұрын

When you changed the user id to 2 it showed as 404 not found, shouldn't any change in the sign url give a 403 status code ? Because it looks like the validation is passing and because there is no user it gives a 404 which will be concerning, if the middleware was working then it should not give a 404. I don't know if i am correct. I'll check

@timothybelekollie6461 7 ай бұрын

I have not implemented this but I was also thinking the same.

@jontyrodrigues 7 ай бұрын

@@timothybelekollie6461 ok i made a new laravel project and sure enough it gives me a 403 forbidden when i change the parameter not sure what happened here strange

@vinit095 7 ай бұрын

403 gives unauthorised which gives you a hint of that user being in the system(exposing user ID). That's why 404. That's my theory(as far as I can think about security)

@timothybelekollie6461 7 ай бұрын

@jontyrodrigues , then it all make sense now with the 403 forbidden code.

@jontyrodrigues 7 ай бұрын

@@vinit095 yupp correct laravel tries to find the user first and then it tries to apply the middleware that is why if there is no user it just gives a 404, which is again bad for security but hey you could use any other implementation such as using uuid.

@nazrinputra 7 ай бұрын

I will use this for board of directors approval email. They won’t need to login or access the system to give a quick approval.

@kizoru8493 7 ай бұрын

What PhpStorm theme do you use?

@ongtheanh1852 7 ай бұрын

it's Carbon bro :)

@devKazuto 7 ай бұрын

If a page or application forces me to go to my inbox and therefore doing an extra step that would otherwise be unnecessary it's a no from me. I'd rather have my browser autofill the input than having open my inbox, click on the link and close the old browser tab. Just like I hate it when pages or applications have the login inputs on different pages or the password input is revealed after submitting the email/username, thus having an extra click.

@spicynoodle7419 7 ай бұрын

I use this for "Shit I forgot my password"

@iWhacko 6 ай бұрын

My god this is such bad practice. let me explain in a couple steps: 1. email is NOT a secure channel. 2. your link might be secure, but you're sending it over an INSECURE channel. 3. You basically allow anyone who know the email to log in without knowing the password, >>> 4. if the email is compromised . 5. you removed the "something you know part" from security principles. 6. why is everyone going to 2fa? 7. to ADD another step: "Something you have". 8. convenience over security is ALWAYS bad. 9. giving a hint, that the email is not found?? BAD gives attackers info to retry with another email.

@esyx6476 4 сағат бұрын

how is that different from clicking "forgot password" if the email is already compromised?