Be part of JetBrains PHPverse 2026 on June 9 – a free online event bringing PHP devs worldwide together.

stesvis's avatar

Fortify - Session store not set on request.

I am trying to implement two factor authentication in an API project. So far I am able to enable/disable 2fa, get the QR code, the recovery codes and everything. Except that I am not able to verify the OTP codes.

I am doing a POST /2fauth/two-factor-challenge passing a payload such as:

{
    code: "123456"
}

I get the code from the Google Authenticator app each time.

In the backend, the route looks like this:

Route::post('2fauth/two-factor-challenge', [TwoFactorAuthenticatedSessionController::class, 'store']);

But the result is a very long exception trace:

{
    "message": "Session store not set on request.",
    "exception": "RuntimeException",
    "file": "R:\NorthStar\portal-backend\vendor\laravel\framework\src\Illuminate\Http\Request.php",
    "line": 502,
    "trace": [
        {
            "file": "R:\NorthStar\portal-backend\vendor\laravel\fortify\src\Http\Requests\TwoFactorLoginRequest.php",
            "line": 104,
            "function": "session",
            "class": "Illuminate\Http\Request",
            "type": "->"
        },
        {
            "file": "R:\NorthStar\portal-backend\vendor\laravel\fortify\src\Http\Controllers\TwoFactorAuthenticatedSessionController.php",
            "line": 57,
            "function": "challengedUser",
            "class": "Laravel\Fortify\Http\Requests\TwoFactorLoginRequest",
            "type": "->"
        },
...

I tried to open the Fortify classes and see where it happens but I still don't understand how to make it work..

Thanks!

0 likes
4 replies
stesvis's avatar

@jlrdw Yes i use this from a react app. In this case i was using postman. I already generate an api token too, but no matter what i get that error.

jlrdw's avatar

@stesvis I am not familiar with react, but maybe Sinnbeck will see this, he uses react.

Does all work without 2fa. Sorry I couldn't help more.

stesvis's avatar

@jlrdw yes it's just that one Fortify route that returns that exception.

Please or to participate in this conversation.