76 lines
2.9 KiB
PHP
76 lines
2.9 KiB
PHP
<?php
|
|
|
|
namespace App\Providers;
|
|
|
|
use App\Actions\Fortify\CreateNewUser;
|
|
use App\Actions\Fortify\ResetUserPassword;
|
|
use App\Actions\Fortify\UpdateUserPassword;
|
|
use App\Actions\Fortify\UpdateUserProfileInformation;
|
|
use Illuminate\Cache\RateLimiting\Limit;
|
|
use Illuminate\Http\Request;
|
|
use Illuminate\Support\Facades\RateLimiter;
|
|
use Illuminate\Support\ServiceProvider;
|
|
use Illuminate\Support\Str;
|
|
use Laravel\Fortify\Actions\RedirectIfTwoFactorAuthenticatable;
|
|
use Laravel\Fortify\Fortify;
|
|
|
|
class FortifyServiceProvider extends ServiceProvider
|
|
{
|
|
/**
|
|
* Register any application services.
|
|
*/
|
|
public function register(): void
|
|
{
|
|
//
|
|
}
|
|
|
|
/**
|
|
* Bootstrap any application services.
|
|
*/
|
|
public function boot(): void
|
|
{
|
|
// Sign-in lands where it was performed: the console on the console's
|
|
// hostname, the portal everywhere else. Fortify's own response sends
|
|
// everyone to the portal, which on a console-only host is a 404.
|
|
// BOTH exits: Fortify never reaches LoginResponse when a two-factor
|
|
// challenge was involved, and binding only that one leaves exactly the
|
|
// accounts most likely to be operators on the old behaviour.
|
|
$this->app->singleton(
|
|
\Laravel\Fortify\Contracts\LoginResponse::class,
|
|
\App\Http\Responses\ConsoleAwareLoginResponse::class,
|
|
);
|
|
$this->app->singleton(
|
|
\Laravel\Fortify\Contracts\TwoFactorLoginResponse::class,
|
|
\App\Http\Responses\ConsoleAwareTwoFactorLoginResponse::class,
|
|
);
|
|
|
|
Fortify::createUsersUsing(CreateNewUser::class);
|
|
Fortify::updateUserProfileInformationUsing(UpdateUserProfileInformation::class);
|
|
Fortify::updateUserPasswordsUsing(UpdateUserPassword::class);
|
|
Fortify::resetUserPasswordsUsing(ResetUserPassword::class);
|
|
Fortify::redirectUserForTwoFactorAuthenticationUsing(RedirectIfTwoFactorAuthenticatable::class);
|
|
|
|
RateLimiter::for('login', function (Request $request) {
|
|
$throttleKey = Str::transliterate(Str::lower($request->input(Fortify::username())).'|'.$request->ip());
|
|
|
|
return Limit::perMinute(5)->by($throttleKey);
|
|
});
|
|
|
|
RateLimiter::for('two-factor', function (Request $request) {
|
|
return Limit::perMinute(5)->by($request->session()->get('login.id'));
|
|
});
|
|
|
|
// Registration is public (no per-account key), so throttle per IP to blunt
|
|
// signup spam / CPU-exhaustion via repeated password hashing.
|
|
RateLimiter::for('registration', fn (Request $request) => Limit::perMinute(10)->by($request->ip()));
|
|
|
|
RateLimiter::for('passkeys', function (Request $request) {
|
|
$credentialId = $request->input('credential.id');
|
|
|
|
return Limit::perMinute(10)->by(
|
|
($credentialId ?: $request->session()->getId()).'|'.$request->ip()
|
|
);
|
|
});
|
|
}
|
|
}
|