Skip to content

[Bug]: ForceTwoFactor middleware triggered before Filament Authenticate authMiddleware #85

Open

Description

@Syourt

What happened?

Not forced to set 2FA when using TwoFactorAuthPlugin::make()->forced().

How to reproduce the bug

Set TwoFactorAuthPlugin::make()->forced() in your panelprovider plugins array:

...
->plugins([
    TwoFactorAuthPlugin::make()->forced(),
])
...

Have authMiddlware set in your panelprovider:

...
->authMiddleware([
    Authenticate::class,
])
...

Repository

No response

Package Version

2.1.3

PHP Version

8.4

Laravel Version

11.44.1

Which operating systems does with happen with?

macOS

Notes

The authenticated user is not known when ForceTwoFactor middleware runs. This is solved by not using TwoFactorAuthPlugin::make()->forced() but just TwoFactorAuthPlugin::make() and manually registering the ForceTwoFactor middlware:

...
->middleware([
    ...
    ForceTwoFactor::class,
])
->authMiddleware([
    Authenticate::class,
])
...

Now the auth user is available in the ForceTwoFactor middleware and the logic works as expected.

Activity

  1. leonadarr commented on Apr 1, 2025

    @leonadarr

    Hi, just to add to this: I'm finding that when adding the middleware manually, it get's stuck in a loop on email-verification/prompt screen when verifying new accounts.

    I had to resolve by adding another request pattern to the handle

    public function handle(Request $request, Closure $next): mixed
        {
            $user = Filament::auth()->user();
    
            if ($request->is('*email-verification*') || $request->is('*two-factor') || $request->is('*logout')) {
                return $next($request);
            }
    ...
    

    This might be worth double checking when you introduce a fix

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions