How to redirect back after confirming password with Fortify?

I am using Fortify for 2FA in my app and when displaying the recovery codes, Fortify's default behavior is to use the password.confirm middleware, which is fine. However, I'm having trouble naturally navigating to it without doing anything that feels too "hacky". And when I get something working, I can't figure out how to return back to the page I was on instead of the route that is set as home for Fortify.

My current function is this

async function loadRecoveryCodes() {
    if (!props.twoFactorEnabled) {
        recoveryCodes.value = [];
        return;
    }

    loadingRecovery.value = true;

    try {
        const { data } = await axios.get(route('two-factor.recovery-codes'));
        recoveryCodes.value = Array.isArray(data) ? data : [];
    } catch (error: any) {
        if (axios.isAxiosError(error)) {
            // If Fortify requires a recent password confirmation, Laravel may
            // respond with a 4xx/redirect. Navigate there via Inertia
            const status = error?.response?.status;
            // From checking browser logs, this is only ever a 423 status code
            if (status === 423) {
                console.log(error?.response);
                router.visit(route('password.confirm'), { preserveScroll: true });
                return;
            }

            console.error('Failed to load recovery codes:', error.response?.data?.message || error.message);
            recoveryCodes.value = [];
        }
    } finally {
        loadingRecovery.value = false;
    }
}

This will work, but this is the scenario I described above. I am manually requesting the password.confirm View, but after confirming, it goes back to /dashboard per my config. Is there a way to have it go back to the settings page I was on where the user clicked the button to display their recovery codes?

Here's Fortify's GET/POST routes for password.confirm

Route::get(RoutePath::for('password.confirm', '/user/confirm-password'), [ConfirmablePasswordController::class, 'show'])
            ->middleware([config('fortify.auth_middleware', 'auth').':'.config('fortify.guard')])
            ->name('password.confirm');

Route::post(RoutePath::for('password.confirm', '/user/confirm-password'), [ConfirmablePasswordController::class, 'store'])
        ->middleware([config('fortify.auth_middleware', 'auth').':'.config('fortify.guard')])
        ->name('password.confirm.store');

Here's my features array from fortify.php

    'features' => [
//        Features::registration(),
//        Features::resetPasswords(),
//        Features::emailVerification(),
        Features::updateProfileInformation(),
        Features::updatePasswords(),
        Features::twoFactorAuthentication([
            'confirm' => true,
            'confirmPassword' => true,
            // 'window' => 0,
        ]),
    ],
];

And here's part of my FortifyServiceProvider.php showing that I'm setting the View for the GET route for this to be my Inertia View. I've commented out the GET route that is set by the Vue Starter Pack.

Fortify::confirmPasswordView(function () {
            return Inertia::render('auth/ConfirmPassword');
        });

How can I go back to my settings/security page and just immediately display the recovery codes? With this above, the user has to manually go back to their settings page and click the button again.

Using form.get instead of router.visit worked one time, but I cannot reproduce it again.

ctrlaltdelme

8 months ago

Level 5

Spent hours on this yesterday to no avail. Could use some help or guiding questions

jlrdw

7 months ago

Level 75

That home route can be customized to one (a controller for example) where you have your custom logic of where to redirect to. Like some if statements there. Just override what you need to.

But 2fa should work out of the box.

Edit:

I have been using custom authentication referenced here: https://laravel.com/docs/12.x/authentication#authenticating-users

And I have a getRedirect function:

    public function authenticate(Request $request)
    {
        $credentials = $request->only('username', 'password');

        if (Auth::attempt($credentials)) {
            $request->session()->regenerate();
            $path = $this->getRedirect();
            return redirect()->intended($path);
        }

        $message = 'The provided credentials do not match our records.';

        return redirect('login')->with('status', $message);
    }

Just example here, as I have more like one for bookkeeping

    public function getRedirect()
    {
        $role = Auth::user()->role;

        $checkrole = explode(',', $role);   // custom authorization used
        if (in_array('admin', $checkrole)) {
            return 'somewhere/index';  // Admin landing page
        } else {
            return 'another_place/index';  // Non admin landing page
        }
    }

But you can do similar with fortify by making some custom redirects.

1 like

ctrlaltdelme

7 months ago

Level 5

I can redirect to a Controller in the home property of fortify.php?

1 like

Please or to participate in this conversation.