Authentication & Security
Secure, robust, and feature-rich authentication system.
Inertia Start includes a robust authentication system built on Laravel’s battle-tested authentication, with a tailored flow and carefully crafted interactions optimized for Inertia.js.
Try the sign-in flowWalk through the login and registration screens in the live demo.
Features
Account Creation
Inertia Start adds an extra verification layer to the account creation process to prevent spam.
Upon receiving a registration request, the system does not immediately create a User entity. Instead, it creates a temporary Registration entity (automatically expiring after 15 minutes) to hold the request while the email is verified. The pending registration is non-blocking, meaning that multiple registration requests for the same email address can be made at the same time. The User entity is only created after the one-time validation code is entered.
This mechanism effectively mitigates spam and prevents malicious actors from locking up email addresses before validation.
Authentication Methods
- Email & Password: Classic login with password reset functionality.
- Magic Links: One-time, temporary secure links to log in without a password.
- External Provider: Log in using an existing account from external providers like Google or X (full list here)
Security
- Email Verification: Enforce email verification at account creation and when changing email addresses.
- Two-Factor Authentication (2FA) (built on Laragear TwoFactor): Users can enable 2FA using TOTP apps (Google Authenticator, Authy, etc.) to further protect their account.
- New Login Alerts: Users receive an email after a new login by default and can control it from their notification preferences.
- Rate Limited Requests: Sensitive actions are protected against brute-force attacks.
- Activity Logs: Important actions are logged, and suspicious activity is monitored. Super admins receive email notifications when rate-limited requests are abused.
Rate limiting / Request throttling
Sensitive actions are rate-limited. Below is the default configuration:
| Action | Configuration |
|---|---|
| Login | 5 attempts / 1 minute (per same IP) 10 attempts / 5 minutes (per same email account) |
| Registration | 4 attempts / 5 minutes (per same IP) 4 attempts / 1 hour (per same email) |
| Resend Registration Code | 3 attempts / 15 minutes |
| Password Reset Request | 4 attempts / 5 minutes (per same IP) 4 attempts / 1 hour (per same email account) |
| Request Email Modification | 2 attempts / 12 hours |
| Resend Email Modification Code | 3 attempts / 1 hour |
To customize these limits, search for Helpers::throttle calls within the application codebase.
Configuration
To enable user accounts, use the I_S_ENABLE_ACCOUNTS environment variable:
I_S_ENABLE_ACCOUNTS=trueAuthentication settings can be configured in config/auth.php (more information in the Laravel Documentation).
Two-factor authentication configuration is located in config/two-factor.php (more information here).