Be part of JetBrains PHPverse 2026 on June 9 – a free online event bringing PHP devs worldwide together.

haydenp's avatar

Override LoginController@authenticated

Hi

I'm using the default Authy for Two Factor Authentication in my Spark app ... but instead forcing users to install the Authy app on their phone (to use Sparks implementation), I've modifying it slightly to use SMS for the 2FA.

I have it working except, the SMS is being sent twice. The reason being, I listen out for the 'Illuminate\Auth\Events\Login' event and my listener sends a request to Auth to send the user the SMS.

However, in the LoginController, Spark checks after a user has authenticated to see if they use 2FA, if they do, Spark stores the users creds, logs them out then redirects to the login/token page. Once the token is verified, the user is logged in again ... hence the 2 SMS messages.

What I'd like to do is to add my call to Auth to send the user the SMS in either the authenticated or redirectForTwoFactorAuth methods. Is this possible? Could there be an easier solution to change Sparks default 2FA behaviour to use Authy SMS?

Cheers, H

// LoginController

    public function authenticated(Request $request, $user)
    {
        if (Spark::usesTwoFactorAuth() && $user->uses_two_factor_auth) {
            return $this->redirectForTwoFactorAuth($request, $user);
        }

        return redirect()->intended($this->redirectPath());
    }

    protected function redirectForTwoFactorAuth(Request $request, $user)
    {
        Auth::logout();

        // Before we redirect the user to the two-factor token verification screen we will
        // store this user's ID and "remember me" choice in the session so that we will
        // be able to get it back out and log in the correct user after verification.
        $request->session()->put([
            'spark:auth:id' => $user->id,
            'spark:auth:remember' => $request->remember,
        ]);

        return redirect('login/token');
    }
0 likes
1 reply
haydenp's avatar

... a temporary workaround I've just put in place is inside the listener, I added logic to check if the Request::path() is 'login' or 'login/token' and only send the SMS if it's 'login'.

... it works, but I'd love to hear if anyone has a 'cleaner' solution to setting up Authy / SMS in Spark?

Please or to participate in this conversation.