Lab 13: Two-Factor Authentication (2FA)

Resources

Overview

In this lab, you will implement Two-Factor Authentication (2FA) for your e-commerce application using TOTP (Time-based One-Time Password). You will generate QR codes for authenticator app setup, create middleware for 2FA verification, and build a “Remember this device” feature. Refer to the Understanding 2FA reading material for background on how TOTP works and why 2FA matters.

Learning Objectives

By completing this lab, you will:

Implement TOTP-based authentication using the robthree/twofactorauth library
Generate QR codes for authenticator app setup
Create middleware for 2FA verification flow
Build a “Remember this device” feature with secure cookies

Prerequisites

Session Middleware lab completed (you will use SessionManager for all session operations)
Authentication Part 2 lab completed (you will apply middleware patterns learned there)
PHP 8.2+
Smartphone with Google Authenticator, Microsoft Authenticator, or Authy app installed

Step 1: Install Required Packages

Open a terminal in VS Code and run the following commands:

composer require robthree/twofactorauth
composer require bacon/bacon-qr-code

Step 2: Import the Database Schema

Open phpMyAdmin, select your project database, click on the “SQL” tab, and execute the following SQL statements:

-- Two-factor authentication table
CREATE TABLE IF NOT EXISTS two_factor_auth (
    id INT AUTO_INCREMENT PRIMARY KEY,
    user_id INT NOT NULL,
    secret VARCHAR(255) NOT NULL,
    enabled BOOLEAN DEFAULT FALSE,
    enabled_at TIMESTAMP NULL,
    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
    updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
    FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE,
    UNIQUE KEY unique_user (user_id)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

-- Trusted devices table for "Remember this device" feature
CREATE TABLE IF NOT EXISTS trusted_devices (
    id INT AUTO_INCREMENT PRIMARY KEY,
    user_id INT NOT NULL,
    device_token VARCHAR(255) UNIQUE NOT NULL,
    device_name VARCHAR(100),
    user_agent VARCHAR(255),
    ip_address VARCHAR(45),
    last_used_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
    expires_at TIMESTAMP NOT NULL,
    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
    FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE,
    INDEX idx_device_token (device_token),
    INDEX idx_user_id (user_id)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

Step 3: Create TwoFactorAuthModel

Create app/Domain/Models/TwoFactorAuthModel.php:

1
<?php
2

3
declare(strict_types=1);
4

5
namespace App\Domain\Models;
6

7
class TwoFactorAuthModel extends BaseModel
8
{
9
    public function findByUserId(int $userId): ?array
10
    {
11
        // TODO: Query the two_factor_auth table to find the record
12
        //       for the given user.
13
    }
14

15
    public function create(int $userId, string $secret): int
16
    {
17
        // TODO: Insert a new 2FA record with the user ID and secret.
18
        //       Return the ID of the created record.
19
    }
20

21
    public function enable(int $userId): bool
22
    {
23
        // TODO: Update the record to mark 2FA as enabled and set
24
        //       the enabled timestamp.
25
    }
26

27
    public function disable(int $userId): bool
28
    {
29
        // TODO: Update the record to mark 2FA as disabled.
30
    }
31

32
    public function isEnabled(int $userId): bool
33
    {
34
        // TODO: Check whether the user has 2FA enabled.
35
    }
36

37
    public function getSecret(int $userId): ?string
38
    {
39
        // TODO: Return the TOTP secret for the given user.
40
    }
41
}

Step 4: Create TwoFactorController

The controller handles 2FA setup (generating QR codes), verification (validating codes during login), and disabling (with password confirmation).

The following are the key TwoFactorAuth and BaconQrCodeProvider methods you will need:

1
$qrProvider = new BaconQrCodeProvider(int $size, string $bgColor, string $fgColor, string $format);
2
$tfa = new TwoFactorAuth(string $issuer, qrcodeprovider: QRCodeProviderInterface $provider);
3
$tfa->createSecret(): string;
4
$tfa->getQRCodeImageAsDataUri(string $label, string $secret): string;
5
$tfa->verifyCode(string $secret, string $code): bool;

Create app/Controllers/TwoFactorController.php:

1
<?php
2

3
declare(strict_types=1);
4

5
namespace App\Controllers;
6

7
use App\Domain\Models\TwoFactorAuthModel;
8
use App\Domain\Models\UserModel;
9
use App\Helpers\FlashMessage;
10
use App\Helpers\SessionManager;
11
use RobThree\Auth\TwoFactorAuth;
12
use RobThree\Auth\Providers\Qr\BaconQrCodeProvider;
13
use Psr\Container\ContainerInterface;
14
use Psr\Http\Message\ResponseInterface as Response;
15
use Psr\Http\Message\ServerRequestInterface as Request;
16

17
class TwoFactorController extends BaseController
18
{
19
    public function __construct(
20
        ContainerInterface $container,
21
        private TwoFactorAuthModel $twoFactorModel,
22
        private UserModel $userModel
23
    ) {
24
        parent::__construct($container);
25
    }
26

27
    public function showSetup(Request $request, Response $response): Response
28
    {
29
        // TODO:
30
        // 1. Query the database to check if the user already has
31
        //    2FA enabled. If so, set a flash error and redirect
32
        //    to the dashboard.
33
        // 2. Create a QR code provider and a TwoFactorAuth instance.
34
        // 3. Generate a new TOTP secret.
35
        // 4. Store the secret in the session temporarily (not in the
36
        //    database yet, since the user has not verified the code).
37
        // 5. Generate a QR code data URI for the authenticator app.
38
        // 6. Render the setup view, passing the QR code and the secret.
39
    }
40

41
    public function verifyAndEnable(Request $request, Response $response): Response
42
    {
43
        // TODO:
44
        // 1. Retrieve the setup secret from the session. If missing,
45
        //    the setup session has expired: redirect to the setup page.
46
        // 2. Verify the submitted code against the session secret.
47
        // 3. If the code is invalid, regenerate the QR code and
48
        //    re-render the setup page with an error message.
49
        // 4. If the code is valid, save the secret to the database
50
        //    and enable 2FA for the user.
51
        // 5. Remove the setup secret from the session.
52
        // 6. Redirect to the dashboard with a success flash message.
53
    }
54

55
    public function showVerify(Request $request, Response $response): Response
56
    {
57
        // TODO: Render the 2FA verification view.
58
    }
59

60
    public function verify(Request $request, Response $response): Response
61
    {
62
        // TODO:
63
        // 1. Retrieve the user's stored TOTP secret from the database.
64
        // 2. Verify the submitted code against the stored secret.
65
        // 3. If the code is invalid, increment a failed attempts counter
66
        //    in the session. After 5 failed attempts, destroy the session
67
        //    and redirect to the login page. Otherwise, re-render the
68
        //    verification page with an error.
69
        // 4. If the code is valid, mark 2FA as verified in the session.
70
        // 5. Clear the attempts counter.
71
        // 6. Regenerate the session ID for security.
72
        // 7. Redirect to the dashboard.
73
    }
74

75
    public function disable(Request $request, Response $response): Response
76
    {
77
        // TODO:
78
        // 1. Retrieve the submitted password from the form data.
79
        // 2. Look up the user in the database and use password_verify()
80
        //    to confirm the password is correct. If invalid, re-render
81
        //    the disable page with an error.
82
        // 3. Disable 2FA in the database for this user.
83
        // 4. Redirect to the dashboard with a success flash message.
84
    }
85

86
    public function showDisable(Request $request, Response $response): Response
87
    {
88
        // TODO: Render the disable confirmation view.
89
    }
90
}

Step 5: Create TwoFactorMiddleware

This middleware runs after AuthMiddleware. It checks whether the authenticated user has 2FA enabled and whether it has been verified in the current session. If 2FA is required but not verified, the user is redirected to the verification page.

Create app/Middleware/TwoFactorMiddleware.php:

1
<?php
2

3
declare(strict_types=1);
4

5
namespace App\Middleware;
6

7
use App\Domain\Models\TwoFactorAuthModel;
8
use App\Helpers\SessionManager;
9
use Psr\Http\Message\ResponseFactoryInterface;
10
use Psr\Http\Message\ServerRequestInterface as Request;
11
use Psr\Http\Server\RequestHandlerInterface as RequestHandler;
12
use Psr\Http\Message\ResponseInterface;
13
use Psr\Http\Server\MiddlewareInterface;
14
use Slim\Routing\RouteContext;
15

16
class TwoFactorMiddleware implements MiddlewareInterface
17
{
18
    public function __construct(
19
        private TwoFactorAuthModel $twoFactorModel,
20
        private ResponseFactoryInterface $responseFactory
21
    ) {
22
    }
23

24
    public function process(Request $request, RequestHandler $handler): ResponseInterface
25
    {
26
        // TODO: Retrieve the user's authentication status from the session.
27
        //       If not authenticated, pass the request to the next handler.
28
        //       If authenticated, check whether the user has 2FA enabled
29
        //       and whether it has been verified this session.
30
        //       If 2FA is required but not verified, redirect to the
31
        //       verification page.
32
        //
33
        //       Use the following to generate the verification URL and
34
        //       create a redirect response:
35
        //       $routeParser = RouteContext::fromRequest($request)->getRouteParser();
36
        //       $verifyUrl = $routeParser->urlFor('2fa.verify');
37
        //       $response = $this->responseFactory->createResponse(302);
38
        //       return $response->withHeader('Location', $verifyUrl);
39
    }
40
}

Step 6: Create Views

6.1: 2FA Setup View

Create app/Views/auth/2fa-setup.php:

1
<?php
2

3
use App\Helpers\ViewHelper;
4

5
ViewHelper::loadHeader($title);
6
?>
7

8
<div class="container mt-5" style="max-width: 500px;">
9
    <h1>Enable Two-Factor Authentication</h1>
10

11
    <?php if (isset($error)): ?>
12
        <div class="alert alert-danger"><?= hs($error) ?></div>
13
    <?php endif; ?>
14

15
    <div class="mb-4">
16
        <h3>Setup Instructions:</h3>
17
        <ol>
18
            <li>Install Google Authenticator or Authy on your smartphone</li>
19
            <li>Scan the QR code below with the app</li>
20
            <li>Enter the 6-digit code from the app to verify</li>
21
        </ol>
22
    </div>
23

24
    <div class="text-center my-4 p-4 bg-white">
25
        <img src="<?= $qrCodeDataUri ?? '' ?>" alt="QR Code for 2FA Setup">
26
    </div>
27

28
    <div class="bg-light p-3 my-4">
29
        <p><strong>Can't scan?</strong> Enter this code manually:</p>
30
        <code style="font-size: 1.2em; letter-spacing: 2px;"><?= hs($secret ?? '') ?></code>
31
    </div>
32

33
    <form method="POST" action="<?= APP_BASE_URL ?>/2fa/verify-and-enable">
34
        <div class="mb-3">
35
            <label for="code" class="form-label">Verification Code:</label>
36
            <input type="text"
37
                   id="code"
38
                   name="code"
39
                   class="form-control text-center"
40
                   pattern="[0-9]{6}"
41
                   maxlength="6"
42
                   required
43
                   autofocus
44
                   placeholder="Enter 6-digit code"
45
                   style="font-size: 1.5em; letter-spacing: 5px;">
46
        </div>
47

48
        <button type="submit" class="btn btn-primary">Verify and Enable 2FA</button>
49
        <a href="<?= APP_BASE_URL ?>/dashboard" class="btn btn-secondary">Cancel</a>
50
    </form>
51
</div>
52

53
<?php ViewHelper::loadFooter(); ?>

6.2: 2FA Verification View

Create app/Views/auth/2fa-verify.php:

1
<?php
2

3
use App\Helpers\ViewHelper;
4

5
ViewHelper::loadHeader($title);
6
?>
7

8
<div class="container mt-5" style="max-width: 400px;">
9
    <h1>Two-Factor Verification</h1>
10
    <p>Enter the 6-digit code from your authenticator app.</p>
11

12
    <?php if (isset($error)): ?>
13
        <div class="alert alert-danger"><?= hs($error) ?></div>
14
    <?php endif; ?>
15

16
    <form method="POST" action="<?= APP_BASE_URL ?>/2fa/verify">
17
        <div class="mb-3">
18
            <label for="code" class="form-label">Verification Code:</label>
19
            <input type="text"
20
                   id="code"
21
                   name="code"
22
                   class="form-control text-center"
23
                   pattern="[0-9]{6}"
24
                   maxlength="6"
25
                   required
26
                   autofocus
27
                   placeholder="000000"
28
                   style="font-size: 2em; letter-spacing: 10px;">
29
        </div>
30

31
        <div class="mb-3">
32
            <label>
33
                <input type="checkbox" name="trust_device" value="1">
34
                Trust this device for 30 days
35
            </label>
36
        </div>
37

38
        <button type="submit" class="btn btn-primary w-100">Verify</button>
39
    </form>
40

41
    <div class="mt-4 text-center">
42
        <form method="POST" action="<?= APP_BASE_URL ?>/logout">
43
            <button type="submit" class="btn btn-link">Cancel and Logout</button>
44
        </form>
45
    </div>
46
</div>
47

48
<?php ViewHelper::loadFooter(); ?>

6.3: 2FA Disable View

Create app/Views/auth/2fa-disable.php:

1
<?php
2

3
use App\Helpers\ViewHelper;
4

5
ViewHelper::loadHeader($title);
6
?>
7

8
<div class="container mt-5" style="max-width: 400px;">
9
    <h1>Disable Two-Factor Authentication</h1>
10
    <p>Enter your password to confirm disabling 2FA.</p>
11

12
    <?php if (isset($error)): ?>
13
        <div class="alert alert-danger"><?= hs($error) ?></div>
14
    <?php endif; ?>
15

16
    <form method="POST" action="<?= APP_BASE_URL ?>/2fa/disable">
17
        <div class="mb-3">
18
            <label for="password" class="form-label">Password:</label>
19
            <input type="password" id="password" name="password" class="form-control" required>
20
        </div>
21

22
        <button type="submit" class="btn btn-danger">Disable 2FA</button>
23
        <a href="<?= APP_BASE_URL ?>/dashboard" class="btn btn-secondary">Cancel</a>
24
    </form>
25
</div>
26

27
<?php ViewHelper::loadFooter(); ?>

6.4: Dashboard View

1
<?php
2

3
use App\Helpers\ViewHelper;
4
use App\Helpers\SessionManager;
5

6
ViewHelper::loadHeader($title);
7
?>
8

9
<div class="container mt-5" style="max-width: 800px;">
10
    <h1>Dashboard</h1>
11

12
    <div class="bg-light p-4 rounded mb-4">
13
        <h2>Welcome, <?= hs(SessionManager::get('user_first_name', 'User')) ?>!</h2>
14
        <p>Email: <?= hs(SessionManager::get('user_email', '')) ?></p>
15
    </div>
16

17
    <hr>
18

19
    <h3>Security Settings</h3>
20

21
    <div class="border rounded p-4 bg-white">
22
        <h4>Two-Factor Authentication (2FA)</h4>
23

24
        <?php if ($has2FA): ?>
25
            <div class="alert alert-success">2FA is enabled</div>
26
            <p>Your account is protected with two-factor authentication.</p>
27
            <a href="<?= APP_BASE_URL ?>/2fa/disable" class="btn btn-danger">Disable 2FA</a>
28
        <?php else: ?>
29
            <div class="alert alert-warning">2FA is disabled</div>
30
            <p>Enable 2FA to add an extra layer of security to your account.</p>
31
            <a href="<?= APP_BASE_URL ?>/2fa/setup" class="btn btn-primary">Enable 2FA</a>
32
        <?php endif; ?>
33
    </div>
34

35
    <hr>
36

37
    <form method="POST" action="<?= APP_BASE_URL ?>/logout">
38
        <button type="submit" class="btn btn-secondary">Logout</button>
39
    </form>
40
</div>
41

42
<?php ViewHelper::loadFooter(); ?>

Step 7: Register Routes

Open app/Routes/web-routes.php and register the following routes for TwoFactorController. Use the same routing syntax from the authentication labs. Remember that middleware is chained using ->add() and executes in reverse order (last added runs first).

Method	Path	Controller Method	Route Name	Middleware
GET	`/2fa/setup`	`showSetup`	`2fa.setup`	`AuthMiddleware`
POST	`/2fa/verify-and-enable`	`verifyAndEnable`	`2fa.enable`	`AuthMiddleware`
GET	`/2fa/verify`	`showVerify`	`2fa.verify`	`AuthMiddleware`
POST	`/2fa/verify`	`verify`	`2fa.verify.post`	`AuthMiddleware`
GET	`/2fa/disable`	`showDisable`	`2fa.disable.show`	`TwoFactorMiddleware`, `AuthMiddleware`
POST	`/2fa/disable`	`disable`	`2fa.disable`	`TwoFactorMiddleware`, `AuthMiddleware`

The setup and verification routes only need AuthMiddleware (the user must be logged in, but does not need to have verified 2FA yet). The disable routes need both AuthMiddleware and TwoFactorMiddleware (the user must have already verified 2FA before they can disable it).

Also update your existing dashboard route to add TwoFactorMiddleware so that users with 2FA enabled must verify before accessing the dashboard.

Update your existing AuthController to integrate 2FA into the login process. Import TwoFactorAuthModel and inject it via the constructor.

In your authenticate() method, add the following after setting the user session data:

1
// TODO:
2
// 1. Query the database to check whether the user has 2FA enabled.
3
// 2. Store the result in the session as 'requires_2fa'.
4
// 3. Set 'two_factor_verified' in the session: if the user does not
5
//    have 2FA enabled, mark it as already verified so they are not
6
//    prompted. If they do have 2FA, mark it as not yet verified.

Update your dashboard() method:

1
public function dashboard(Request $request, Response $response): Response
2
{
3
    // TODO:
4
    // 1. Query the database to check whether the current user has
5
    //    2FA enabled.
6
    // 2. Render 'dashboard.php', passing the 2FA status so the
7
    //    view can display the correct toggle button.
8
}

Step 9: Create TrustedDeviceModel

This model manages the “Remember this device” feature, allowing users to skip 2FA on trusted devices for 30 days.

Create app/Domain/Models/TrustedDeviceModel.php:

1
<?php
2

3
declare(strict_types=1);
4

5
namespace App\Domain\Models;
6

7
class TrustedDeviceModel extends BaseModel
8
{
9
    public function create(int $userId, string $deviceToken, array $deviceInfo): int
10
    {
11
        // TODO: Insert a new record into the trusted_devices table with the
12
        //       user ID, device token, and device info (name, user agent,
13
        //       IP address, expiration date).
14
    }
15

16
    public function isValid(string $deviceToken, int $userId): bool
17
    {
18
        // TODO: Check whether the token exists, belongs to the user,
19
        //       and has not expired.
20
    }
21

22
    public function updateLastUsed(string $deviceToken): bool
23
    {
24
        // TODO: Update the last_used_at timestamp for the device.
25
    }
26

27
    public function getAllByUserId(int $userId): array
28
    {
29
        // TODO: Return all non-expired trusted devices for the user.
30
    }
31

32
    public function revoke(int $deviceId, int $userId): bool
33
    {
34
        // TODO: Delete the device record. Include user_id in the
35
        //       WHERE clause to prevent unauthorized deletion.
36
    }
37

38
    public function revokeAll(int $userId): bool
39
    {
40
        // TODO: Delete all trusted devices for the user.
41
    }
42
}

Step 10: Update TwoFactorController for Device Trust

Update the TwoFactorController constructor to inject TrustedDeviceModel:

1
use App\Domain\Models\TrustedDeviceModel;
2

3
public function __construct(
4
    ContainerInterface $container,
5
    private TwoFactorAuthModel $twoFactorModel,
6
    private UserModel $userModel,
7
    private TrustedDeviceModel $trustedDeviceModel
8
) {
9
    parent::__construct($container);
10
}

Then add device trust functionality to the verify() method, after the line SessionManager::set('two_factor_verified', true);:

1
$trustDevice = $data['trust_device'] ?? false;
2

3
if ($trustDevice) {
4
    // TODO: Generate a secure random device token.
5
    //       Calculate the expiration date (30 days from now).
6
    //       Build a device info array with the device name, user agent,
7
    //       IP address, and expiration date.
8
    //       Save the trusted device to the database.
9
    //       Set a secure cookie named 'trusted_device' with the token,
10
    //       configured with httponly and samesite flags.
11
}

Add helper methods to TwoFactorController:

1
private function getDeviceName(Request $request): string
2
{
3
    $userAgent = $request->getHeaderLine('User-Agent');
4

5
    if (stripos($userAgent, 'Windows') !== false) return 'Windows PC';
6
    if (stripos($userAgent, 'Mac') !== false) return 'Mac';
7
    if (stripos($userAgent, 'iPhone') !== false) return 'iPhone';
8
    if (stripos($userAgent, 'Android') !== false) return 'Android';
9
    if (stripos($userAgent, 'Linux') !== false) return 'Linux PC';
10

11
    return 'Unknown Device';
12
}
13

14
private function getClientIp(Request $request): string
15
{
16
    $serverParams = $request->getServerParams();
17

18
    if (!empty($serverParams['HTTP_X_FORWARDED_FOR'])) {
19
        $ipList = explode(',', $serverParams['HTTP_X_FORWARDED_FOR']);
20
        return trim($ipList[0]);
21
    }
22

23
    return $serverParams['REMOTE_ADDR'] ?? '0.0.0.0';
24
}

Step 11: Update TwoFactorMiddleware for Device Trust

Update the TwoFactorMiddleware constructor to inject TrustedDeviceModel:

1
use App\Domain\Models\TrustedDeviceModel;
2

3
public function __construct(
4
    private TwoFactorAuthModel $twoFactorModel,
5
    private TrustedDeviceModel $trustedDeviceModel,
6
    private ResponseFactoryInterface $responseFactory
7
) {
8
}

Add trusted device check in the process() method, after checking if 2FA is enabled but before redirecting to the verification page:

1
$cookies = $request->getCookieParams();
2
$deviceToken = $cookies['trusted_device'] ?? null;
3

4
if ($deviceToken) {
5
    if ($this->trustedDeviceModel->isValid($deviceToken, $userId)) {
6
        SessionManager::set('two_factor_verified', true);
7
        $this->trustedDeviceModel->updateLastUsed($deviceToken);
8

9
        return $handler->handle($request);
10
    } else {
11
        setcookie('trusted_device', '', time() - 3600, '/' . APP_ROOT_DIR_NAME);
12
    }
13
}

Step 12: Applying 2FA to Your Admin Panel

Add TwoFactorMiddleware to your admin route group so that all admin routes require 2FA verification:

1
$app->group('/admin', function ($group) {
2
    $group->get('/dashboard', [AdminController::class, 'dashboard']);
3
    $group->get('/users', [AdminController::class, 'users']);
4
    $group->get('/products', [ProductsController::class, 'index']);
5
    $group->post('/products/create', [ProductsController::class, 'createProduct']);
6
    // ... other admin routes
7
})
8
->add(TwoFactorMiddleware::class)
9
->add(AdminAuthMiddleware::class)
10
->add(AuthMiddleware::class);

Middleware executes in reverse order of the ->add() calls:

Request → AuthMiddleware → AdminAuthMiddleware → TwoFactorMiddleware → Controller
              ↓                   ↓                    ↓
        "Is logged in?"    "Is user admin?"    "Is 2FA verified?"

You can also require admin users to enable 2FA before accessing the admin panel. Update your AdminAuthMiddleware to inject TwoFactorAuthModel and check whether the admin has 2FA enabled. If not, redirect them to the 2FA setup page with a flash message.

1
// After verifying the user is an admin, check if 2FA is enabled:
2
$userId = SessionManager::get('user_id');
3

4
if (!$this->twoFactorModel->isEnabled($userId)) {
5
    FlashMessage::warning('Admin accounts require Two-Factor Authentication. Please enable 2FA to continue.');
6

7
    $routeParser = RouteContext::fromRequest($request)->getRouteParser();
8
    $setupUrl = $routeParser->urlFor('2fa.setup');
9

10
    $response = $this->responseFactory->createResponse(302);
11
    return $response->withHeader('Location', $setupUrl);
12
}

Testing Your Implementation

Enable 2FA: login, visit /2fa/setup, scan the QR code with your authenticator app, enter the 6-digit code. Verify 2FA is enabled on the dashboard.
Login with 2FA: logout, login again. After entering your password, you should be redirected to /2fa/verify. Enter the correct code to reach the dashboard.
Failed attempts: enter 5 incorrect codes. You should be logged out and the session destroyed.
Disable 2FA: navigate to the disable page, enter an incorrect password (should show error), then enter the correct password. Verify the next login does not require 2FA.
Trust device: login with 2FA, check “Trust this device for 30 days”, and verify. Logout and login again: you should skip 2FA verification. Open a different browser or incognito window and login: you should still be prompted for 2FA.