https://github.com/beastbytes/yii-otp
One Time Passwords (OTP) (HOTP or TOTP algorithm) in Yii3 applications
https://github.com/beastbytes/yii-otp
Last synced: 13 days ago
JSON representation
One Time Passwords (OTP) (HOTP or TOTP algorithm) in Yii3 applications
- Host: GitHub
- URL: https://github.com/beastbytes/yii-otp
- Owner: beastbytes
- License: bsd-3-clause
- Created: 2025-04-12T15:10:29.000Z (12 months ago)
- Default Branch: master
- Last Pushed: 2025-10-18T21:04:12.000Z (6 months ago)
- Last Synced: 2025-10-19T09:56:43.411Z (6 months ago)
- Language: PHP
- Size: 178 KB
- Stars: 0
- Watchers: 1
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: LICENSE.md
Awesome Lists containing this project
README
# BeastBytes Yii OTP
BeastBytes Yii OTP simplifies integrating Two-Factor Authentication (2FA) using either
**HOTP** (HMAC One-Time Password - [RFC 4226](https://datatracker.ietf.org/doc/html/rfc4226)) or
**TOTP** (Time-based One-Time Password - [RFC 6238](https://datatracker.ietf.org/doc/html/rfc6238))
into Yii3 applications.
## Requirements
* PHP 8.2 or higher.
## Installation
```php
composer require beastbytes/yii-otp
```
or add the following to the 'require' section composer.json:
```json
"beastbytes/yii-otp": ""
```
## Usage
The application interacts with either HtopService or TotpService.
**NOTE:** Code examples show only the core functionality; they do not show dependency injections, support methods, etc.
### Configuration
The default configuration is for **TOTP** and is compatible with authenticator apps such as
Google Authenticator, Aegis, etc.
### Enable OTP
```php
// Otp Controller
public function enable(
CurrentUser $currentUser,
FormHydrator $formHydrator,
ServerRequestInterface $request,
): ResponseInterface
{
$formModel = new OtpForm($this->otpService);
if ($formHydrator->populateFromPostAndValidate($formModel, $request)) {
$this->redirct('ShowBackupCodes');
}
['qrCode', 'secret'] = $this->otpService->createOtp($currentUser->getId());
return $this->viewRenderer->render(
'enable2faView',
[
'formModel' => $formModel,
'qrCode' => $qrCode,
'secret' => $secret,
]
);
}
```
```php
// enable OTP View
Either scan the QR Code or manually enter the 2FA code into
your 2FA app, then enter the OTP code generated by the app.
2FA Code
= $secret ?>
= $form
->post($url)
->csrf($csrf)
->open()
; ?>
= Field::text($formModel, 'code') ?>
= Field::submitButton('Verify') ?>
= $form->close() ?>
```
### Verify TOTP
```php
// Otp Controller
public function verify(
CurrentUser $currentUser,
FormHydrator $formHydrator,
ServerRequestInterface $request,
): ResponseInterface
{
$formModel = new OtpForm($this->otpService, true);
if ($formHydrator->populateFromPostAndValidate($formModel, $request)) {
$this->redirct('verified');
}
return $this->viewRenderer->render(
'enable2faView',
[
'formModel' => $formModel,
]
);
}
```
```php
// Verify OTP View
= $form
->post($url)
->csrf($csrf)
->open()
; ?>
= Field::text($formModel, 'code') ?>
= Field::submitButton('Verify') ?>
= $form->close() ?>
```
### OTPForm
```php
final class OtpForm extends FormModel
{
private string $otpCode = '';
public function __construct(
private readonly OtpServiceInterface $otpService,
private readonly bool $allowBackupCode = false
)
{
}
public function getRules(): array
{
return [
'otpCode' => [
new Required(),
new Regex(($this->allowBackupCode ? '/.+/' : '/\d{3}\s?\d{3}/')),
new Callback(
callback: function (): Result {
$result = new Result();
if (!$this->otpService->verify(str_replace(' ', '', $this->otpCode))) {
$result->addError('Invalid Code');
}
return $result;
},
),
]
];
}
}
```