How to Make a Passwordless Login System In Laravel

Подписаться 60 тыс.

Просмотров 10 тыс.

50% 1

In this Larabit, I'll show you how to build a passwordless authentication system from scratch. We'll start with Laravel's Breeze scaffolding, and then we'll perform the necessary adjustments to make it passwordless. Specifically, we'll leverage temporary signed URLs to make the entire process a cinch!
Watch thousands of videos, track your progress, and participate in a massive Laravel community at Laracasts.com.
Laracasts: laracasts.com
Laracasts Twitter: / laracasts
Jeffrey Way Twitter: / jeffrey_way

Опубликовано:

23 окт 2023

Ссылка:

Скачать:

Готовим ссылку...

Добавить в:

Мой плейлист

Посмотреть позже

Комментарии : 40

@christogonusobasi7882 7 месяцев назад

I like the fact that you show how you debug in real life. It gives me confidence that I am not a dull lad. When I watch error-free screencasts, I feel like there is a stage in programming when you are not supposed to ever have an error in your code! Meanwhile, I got Laracast's lifetime account so that I can just copy and use straight out of the box. If you have done it, why should I repeat 🤭🤭

@user-zn7fm1su8x 10 дней назад

thabk you laraway, you are the best.

@vinit095 8 месяцев назад

At least you are also victim of random problem occuring when making a video and debugging on point. Not like other people who just doing copy paste from their 2nd screen 😅. ❤

@andresgutgon 8 месяцев назад

So easy. I'm in love with Laravel

@aogunnaike 8 месяцев назад

Thanks for this 🙏

@enrica6616 8 месяцев назад

Thank you for this great explanation. Passwordless would be better with passkey or Fido2. Is it possible to extend your example app with passkeys?

@WhatsMyGame-hc3pr 8 месяцев назад

Great teaching as always. One quick note: I would also give positive feedback to the user in case the provided e-mail address is not in the database. This prevents guessing website users.

@DeveloperChris 8 месяцев назад

Bad option. Bad actors continue to submit email addresses until they find as many as they need. Feedback makes it easy for them.

@codesmiles_ 8 месяцев назад

I'll get to know this stuff soon

@bulent2435 8 месяцев назад

perfect.

@nelsonmelecio 8 месяцев назад

I also do ray() most in my development and ray does encodes html entities in the URL most of the times..

@wakcodes 8 месяцев назад

Your videos are awesome; however, I really like the way you set up your editor. Can you please share how I can set up mine like yours?

@trippthree8842 8 месяцев назад

Yes please!

@DeveloperChris 8 месяцев назад

While simple security like this may seem a positive step and make life easier for your users. It's not. What if the user no longer has access to the email address? How do they log in to change it? This system can also be used in a password reset attack if the implementation Isn't protected against it. Some email systems can take quite a while before the email is delivered. For example my ISP delays emails by up to 10 min. Which means I have to wait 10 minutes before I can log in.

@devKazuto 8 месяцев назад

Or not at all if the URL is valid for 5 minutes but the mail takes longer to arrive. Or your mail server is down and thus can't login. Password has always been the standard and will always be. Even Yubikey will probably never see widespread adoption, cause you'd have to carry it with you everywhere you go and if you lose it you can't just reset your password.

@arif-khan 8 месяцев назад

A question: When you hit the url with user id 2, laravel is throwing "404 | Not Found", probably because user does not exists in the database. I may be wrong, but it should throw "403 | Invalid Url" or "403 | Invalid Signature" whatever it is. I guess, Laravel is allowing the URL to be hit the method "loginWithToken" with user ID 2. Please correct me If I am wrong. Always enjoy Laracasts' Video. Keep Posting.

@richard_keep 8 месяцев назад

Just tested manually and Jeffrey is right. I have a user with ID 2 and when I manually edit the URL I get the 403 INVALID SIGNATURE response.

@arif-khan 8 месяцев назад

@@richard_keep noted

@MarkSnape 7 месяцев назад

This is because route model binding is performed before the validation of the signed route. So when there is no record 2, you get a 404, but if there is a record with ID of 2 then the route model binding works and the invalid signature occurs.

@borakayalar 7 месяцев назад

This approch can be used for admins, sometimes admin wants to see user screen so if it has implemented for only admin users than admin can check the user screen. And Admin does need to know user's password. It is very usefull for me. It is exacly what I want. Many thaks.

@iWhacko 7 месяцев назад

you have the "impersonate feature" in a couple of laravel plugins. don't use this method. it's insecure

@borakayalar 7 месяцев назад

@@iWhacko you are right! Maybe we can add another session guard and admin can login with this guarded new session. If I am wrong, sorry coz, I'm new into laravel :) still I am trying to learn detailed concept for laravel. There are many tutorails about it but anyone can not tell detailed approch , lifecycles, logic etc.... Such as service containers, providers, configs very important. When use them, you can figure it out very easyly to diffucult process. And kernel logic very important. No one does not dive to into kernel.

@jontyrodrigues 8 месяцев назад

When you changed the user id to 2 it showed as 404 not found, shouldn't any change in the sign url give a 403 status code ? Because it looks like the validation is passing and because there is no user it gives a 404 which will be concerning, if the middleware was working then it should not give a 404. I don't know if i am correct. I'll check

@timothybelekollie6461 8 месяцев назад

I have not implemented this but I was also thinking the same.

@jontyrodrigues 8 месяцев назад

@@timothybelekollie6461 ok i made a new laravel project and sure enough it gives me a 403 forbidden when i change the parameter not sure what happened here strange

@vinit095 8 месяцев назад

403 gives unauthorised which gives you a hint of that user being in the system(exposing user ID). That's why 404. That's my theory(as far as I can think about security)

@timothybelekollie6461 8 месяцев назад

@jontyrodrigues , then it all make sense now with the 403 forbidden code.

@jontyrodrigues 8 месяцев назад

@@vinit095 yupp correct laravel tries to find the user first and then it tries to apply the middleware that is why if there is no user it just gives a 404, which is again bad for security but hey you could use any other implementation such as using uuid.

@kizoru8493 8 месяцев назад

What PhpStorm theme do you use?

@ongtheanh1852 8 месяцев назад

it's Carbon bro :)

@nazrinputra 8 месяцев назад

I will use this for board of directors approval email. They won’t need to login or access the system to give a quick approval.

@devKazuto 8 месяцев назад

If a page or application forces me to go to my inbox and therefore doing an extra step that would otherwise be unnecessary it's a no from me. I'd rather have my browser autofill the input than having open my inbox, click on the link and close the old browser tab. Just like I hate it when pages or applications have the login inputs on different pages or the password input is revealed after submitting the email/username, thus having an extra click.

@spicynoodle7419 8 месяцев назад

I use this for "Shit I forgot my password"

@iWhacko 7 месяцев назад

My god this is such bad practice. let me explain in a couple steps: 1. email is NOT a secure channel. 2. your link might be secure, but you're sending it over an INSECURE channel. 3. You basically allow anyone who know the email to log in without knowing the password, >>> 4. if the email is compromised . 5. you removed the "something you know part" from security principles. 6. why is everyone going to 2fa? 7. to ADD another step: "Something you have". 8. convenience over security is ALWAYS bad. 9. giving a hint, that the email is not found?? BAD gives attackers info to retry with another email.

@esyx6476 19 дней назад

how is that different from clicking "forgot password" if the email is already compromised?

@iWhacko 14 дней назад

@@esyx6476 if you click forgot password, and the service immediately sends you a new password, yes thats bad. That's why we have security questions, to verify identity. Or nowadays, people have devices linked to their account, which can verify identity before setting a new password. NOT mailing it.