laravel / fortify

Backend controllers and scaffolding for Laravel authentication.
https://laravel.com/docs/fortify
MIT License
1.63k stars 299 forks source link

[1.x] Rehash password if required when user uses two factor #557

Closed gdebrauwer closed 4 months ago

gdebrauwer commented 4 months ago

In Laravel 11, "automatic rehashing of user passwords when validating credentials" was added as a feature (https://github.com/laravel/framework/pull/48665). This PR ensures this feature also works when a user uses two-factor authentication.

When a user with two-factor enters their username and password, the user is not logged in because the user is redirected to the two-factor challenge page. This means the password rehashing is not triggered because it is only triggered when the user is immediately logged in when validating the credentials.