I am using laravel 5.4 building an API where I email the user a token on password reset if user verified, which user provides before resetting password. Currently the sent token has 64 characters and too large for user to grab, and I'm not sure if laravel has configuration to give a custom length to token?
1条回答 默认 最新
- dongsigan2636 2017-10-03 14:23关注
The solution is a little bit tricky, ill try to explain the procedure as clearly as possible:
STEP 1 - Extend the standard DatabaseTokenRepository
Create a class that extends
Illuminate\Auth\Passwords\DatabaseTokenRepository
in order to define a new token creation policy.<?php namespace App\Auth\Passwords; use Illuminate\Auth\Passwords\DatabaseTokenRepository; class CustomDatabaseTokenRepository extends DatabaseTokenRepository { // Overrides the standard token creation function public function createNewToken() { retrun substr(parent::createNewToken(), 0, 30); } }
I've just trimmed the token generated by Laravel down to 30 chars, feel free to implement your own token generation routine.
STEP 2 - Extend the standard PasswordBrokerManager
Now you have to tell the
PasswordBrokerManager
to use your token repository instead of the standard one. In order to do so you have to extend the classIlluminate\Auth\Passwords\PasswordBrokerManager
.<?php namespace App\Auth\Passwords; use Illuminate\Auth\Passwords\PasswordBrokerManager; class CustomPasswordBrokerManager extends PasswordBrokerManager { // Override the createTokenRepository function to return your // custom token repository instead of the standard one protected function createTokenRepository(array $config) { $key = $this->app['config']['app.key']; if (Str::startsWith($key, 'base64:')) { $key = base64_decode(substr($key, 7)); } $connection = isset($config['connection']) ? $config['connection'] : null; return new CustomDatabaseTokenRepository( $this->app['db']->connection($connection), $this->app['hash'], $config['table'], $key, $config['expire'] ); } }
STEP 3 - Extend the standard
PasswordResetServiceProvider
Now you have to extend the standard
Illuminate\Auth\Passwords\PasswordResetServiceProvider
in order to tell Laravel to instantiate yourCustomPasswordBrokerManager
.<?php namespace App\Auth\Passwords; use Illuminate\Auth\Passwords\PasswordResetServiceProvider; class CustomPasswordResetServiceProvider extends PasswordServiceProvider { // Override the method registerPasswordBroker // in order to specify your customized manager protected function registerPasswordBroker() { $this->app->singleton('auth.password', function ($app) { return new CustomPasswordBrokerManager($app); }); $this->app->bind('auth.password.broker', function ($app) { return $app->make('auth.password')->broker(); }); } }
STEP 4 - Final step, replace the provider in
config/app.php
Comment out the following line in your
config/app.php
files under theproviders
key:// Illuminate\Auth\Password\PasswordResetServiceProvider::class,
And add the following line just below:
App\Auth\Passwords\CustomPasswordResetServiceProvider::class,
CONSIDERATIONS
Be careful when doing such things, the token is defined as
hash_hmac('sha256', Str::random(40), $this->hashKey)
where$this->hasKey
isenv('APP_KEY
). This is used to ensure that no collision will occur when generating password reset tokens. I suggest you to investigate a secure method to reduce your token length securely.本回答被题主选为最佳回答 , 对您是否有帮助呢?解决 无用评论 打赏 举报
悬赏问题
- ¥15 执行 virtuoso 命令后,界面没有,cadence 启动不起来
- ¥50 comfyui下连接animatediff节点生成视频质量非常差的原因
- ¥20 有关区间dp的问题求解
- ¥15 多电路系统共用电源的串扰问题
- ¥15 slam rangenet++配置
- ¥15 有没有研究水声通信方面的帮我改俩matlab代码
- ¥15 ubuntu子系统密码忘记
- ¥15 保护模式-系统加载-段寄存器
- ¥15 电脑桌面设定一个区域禁止鼠标操作
- ¥15 求NPF226060磁芯的详细资料