Two Factor Authentication

Package: avisaas/twofactor

Compatibility/Notes: Works standalone — Compatible with TastyIgniter 4.x on PHP 8.2+.

Features

Three Authentication Methods

Email OTP — A 6-digit one-time code is sent to the admin's email address on every login.
Phone / SMS OTP — A 6-digit code is sent via SMS (Twilio or Vonage/Nexmo).
Google Authenticator (TOTP) — Time-based codes using any TOTP app (Google Authenticator, Authy, 1Password, etc.). No email or SMS dependency.

The 2FA challenge appears on the same login page — no separate challenge page. After the admin submits their username/password, the login form is replaced with a 6-digit code field inline. The user is kept on /admin/login throughout.

Cancel button clears the pending session and returns to the normal login form
Resend button re-sends a fresh code (email/SMS types only)
Google Authenticator codes work immediately with no resend needed

Google Authenticator Setup Wizard

Admins set up Google Authenticator from their own profile page (Admin Users → Edit Profile → Two Factor tab):

Click Setup Now → redirected to the setup wizard
Requirements card — shows whether pragmarx/google2fa-laravel is installed with a one-click Install package button that runs composer require in the background
Scan QR code — a QR code is displayed for scanning with any authenticator app
Manual key — the secret is shown in groups of 4 characters for manual entry
Verify — enter the 6-digit code to confirm and enable 2FA on the account
Regenerate — a reset link in the card footer lets the admin invalidate the old QR code and generate a new one

One-Click Package Install

The setup page includes a live install button that runs composer require pragmarx/google2fa-laravel via PHP exec(). Output is shown in a scrollable terminal-style panel. The page reloads automatically after a successful install.

Works on shared hosting with:

No HOME environment variable (uses HOME=/tmp COMPOSER_HOME=/tmp)
PHP 8.2 servers where composer.json requires PHP 8.3 (--ignore-platform-req=php)
Artisan post-install hooks that fail on PHP 8.2 (--no-scripts)

Security Overview Panel (Setup Tab)

The Settings → Setup tab runs a live security checklist on your server and application — no manual inspection needed.

Application Security

Check	What it verifies
Database migrations applied	All 2FA columns exist in the database
2FA globally enabled	The `enable_2fa` setting is on
Mail / SMS provider configured	A delivery method is set
APP_KEY set	Laravel encryption key is present
Debug mode disabled	`APP_DEBUG=false` in production
HTTPS in APP_URL	`APP_URL` starts with `https://`
Cache driver	Not using `array` or `null` driver

HTTP & Server Hardening

Check	What it verifies
Sensitive files blocked	`.env`, `.sql`, `.log` requests are denied
Composer files blocked	`composer.json`, `composer.lock` are not publicly accessible
Double-extension uploads blocked	`shell.php.jpg` style uploads rejected
Storage: PHP execution blocked	PHP cannot execute inside the storage directory
X-Frame-Options: SAMEORIGIN	Clickjacking protection header present
Content-Security-Policy header	CSP header present
X-Content-Type-Options: nosniff	MIME sniffing protection
Referrer-Policy	`strict-origin-when-cross-origin` set
Permissions-Policy	Camera, microphone, geolocation disabled
X-Powered-By header removed	PHP version not leaked in response headers
Trailing slash redirect	Canonical URL redirect (301) active
Installer directory locked	Web installer is not publicly accessible

One-click Apply Hardening button writes the missing rules to .htaccess automatically.

SMS Provider Support

Configure SMS delivery under Settings → SMS:

Provider	Credentials Required
Twilio	Account SID, Auth Token, From Number
Vonage (Nexmo)	API Key, API Secret, From Name/Number

Per-User Status in Admin Panel

The Admin Users → Edit → Two Factor tab shows each user's current 2FA status:

Method configured (None / Email / Phone / Google Authenticator)
Whether 2FA is currently enabled on the account
A direct Setup Now or Reconfigure button (own profile only; superadmins see status for all users)

License-Protected

Every feature is gated behind a valid license key. Without an active license:

2FA is not enforced on login
Settings tabs (General, SMS, Setup) are replaced with a "License Required" notice
The setup wizard shows an "Activate License" prompt
All AJAX handlers return an error

Screenshots

Public screenshots

Public versions are available at: https://github.com/avisaas/extension-screenshots/tree/main/twofactor

Requirements

TastyIgniter 4.x (Laravel 12)
PHP 8.2 or higher
A valid Avisaas Two Factor license key
pragmarx/google2fa-laravel (installable via the one-click button in Settings → Setup)

Installation

This extension is available for purchase from the Avisaas marketplace. After payment you will receive the extension files. Install them using one of the methods below.

Option A: Manual install via SSH

Upload the avisaas/twofactor folder to extensions/avisaas/twofactor on your server.
In the Admin panel go to System → Extensions and enable Two Factor Authentication.
Run migrations:

php artisan igniter:up

Clear caches:

php artisan cache:clear
php artisan config:clear
php artisan view:clear

Option B: FTP install (No SSH required)

Upload the avisaas/twofactor folder via FTP to extensions/avisaas/twofactor.
Enable the extension in System → Extensions.
Go to Two Factor Settings → Setup tab → Run Migrations.

Configuration

1. Activate your license

Go to System → Settings → Two Factor Authentication → License tab. Enter your license key and save. The status badge turns green when the key is valid.

2. Enable 2FA enforcement

Go to the General tab and toggle Enable Two Factor Authentication on.

3. (Optional) Configure SMS

Go to the SMS tab, select your provider (Twilio or Vonage), enter credentials, and save.

4. Set up Google Authenticator per user

Each admin goes to Admin Users → Edit (own profile) → Two Factor tab → Setup Now. They scan the QR code with their authenticator app and enter the 6-digit code to confirm.

License

Commercial — requires a valid license key from avisaas.com. One license per domain. License keys are validated against the domain set in APP_URL.

Two Factor Authentication

Two Factor Authentication