HELO

The Power of Frontend-Agnostic Authentication Laravel Fortify serves as the engine under the hood for more prescriptive starter kits like Jetstream. It handles the heavy lifting of security—authentication, registration, and two-factor logic—without forcing a specific UI on you. This makes it the premier choice when you need a custom Tailwind%20UI design or a specialized frontend framework like React or Vue without the overhead of a pre-built starter kit. Prerequisites and Installation To follow along, you should be comfortable with Laravel 10+ and PHP. You'll also need a local development environment. Start by creating a fresh Laravel project and installing the package via Composer. ```bash composer require laravel/fortify php artisan fortify:install ``` This installation publishes several actions into your `app/Actions/Fortify` directory. These are plain PHP classes that handle logic like `CreateNewUser` or `UpdateUserProfile`. Since they live in your app, you can modify them to include extra fields like phone numbers or company IDs easily. Registering Custom Views Because Fortify is "headless," it doesn't know where your login or registration templates live. You must tell Fortify which views to render using the `FortifyServiceProvider`. Inside the `boot` method, use the `Fortify::loginView` and `Fortify::registerView` methods to return your custom Blade templates. ```php Fortify::loginView(function () { return view('auth.login'); }); ``` In your login form, ensure your `action` points to the `login` route and includes a `@csrf` token. Fortify automatically handles the validation and session management once the form is submitted. Implementing Email Verification Securing your application often requires verifying user identity. First, your `User` model must implement the `MustVerifyEmail` interface. Next, enable the feature in `config/fortify.php` by uncommenting `Features::emailVerification()`. Finally, register the view in your provider: ```php Fortify::verifyEmailView(function () { return view('auth.verify-email'); }); ``` By adding the `verified` middleware to your routes, Laravel will automatically redirect unverified users to this view until they click the link sent to their inbox. Handling Password Resets Password recovery is a multi-step process. You need a view to request the reset link and another to actually set the new password. The reset view requires the current `request` object to access the unique reset token. ```php Fortify::resetPasswordView(function ($request) { return view('auth.reset-password', ['request' => $request]); }); ``` In the reset form, you must include a hidden input for the token: `<input type="hidden" name="token" value="{{ $request->route('token') }}">`. This ensures the security handshake between the email link and your database remains intact. Syntax Notes and Best Practices Fortify relies heavily on the **Action Pattern**. Instead of bloated controllers, logic is encapsulated in single-responsibility classes. When customizing, always check `config/fortify.php` first. It controls everything from rate limiting to which features are active. For local email testing, tools like HELO or Mailtrap are indispensable for catching verification and reset emails without sending them to real addresses.