I am trying to implement two factor authentication in an API project.
So far I am able to enable/disable 2fa, get the QR code, the recovery codes and everything.
Except that I am not able to verify the OTP codes.
I am doing a POST /2fauth/two-factor-challenge passing a payload such as:
{
code: "123456"
}
I get the code from the Google Authenticator app each time.
In the backend, the route looks like this:
Route::post('2fauth/two-factor-challenge', [TwoFactorAuthenticatedSessionController::class, 'store']);
But the result is a very long exception trace:
{
"message": "Session store not set on request.",
"exception": "RuntimeException",
"file": "R:\NorthStar\portal-backend\vendor\laravel\framework\src\Illuminate\Http\Request.php",
"line": 502,
"trace": [
{
"file": "R:\NorthStar\portal-backend\vendor\laravel\fortify\src\Http\Requests\TwoFactorLoginRequest.php",
"line": 104,
"function": "session",
"class": "Illuminate\Http\Request",
"type": "->"
},
{
"file": "R:\NorthStar\portal-backend\vendor\laravel\fortify\src\Http\Controllers\TwoFactorAuthenticatedSessionController.php",
"line": 57,
"function": "challengedUser",
"class": "Laravel\Fortify\Http\Requests\TwoFactorLoginRequest",
"type": "->"
},
...
I tried to open the Fortify classes and see where it happens but I still don't understand how to make it work..
Thanks!