This package implement a "google like" device detection.
You can detect when an user is using a new device and manage the verified status between user and device.
You can also detect a possible device hijacking.
You can install the package via composer:
composer require ivanomatteo/laravel-device-tracking
php artisan migrate
Publish config file:
php artisan vendor:publish --provider "IvanoMatteo\LaravelDeviceTracking\LaravelDeviceTrackingServiceProvider" --tag config
// add the trait to your user model
class User{
//...
use IvanoMatteo\LaravelDeviceTracking\Traits\UseDevices;
//...
}
//call on login or when you want update and check the device informations
$device = \DeviceTracker::detectFindAndUpdate();
// flag as verfified for the current user
\DeviceTracker::flagCurrentAsVerified();
// flag as verfified for a specific user
\DeviceTracker::flagAsVerified($device, $user_id);
// flag as verfified for a specific user by device uuid
\DeviceTracker::flagAsVerifiedByUuid($device_uuid, $user_id);
// if you are using laravel/ui (classic scaffolding)
// a good place where detectFindAndUpdate() is in the login controller
// App\Http\Controllers\Auth\LoginController
// by adding this method:
protected function authenticated(Request $request, $user)
{
$device = \DeviceTracker::detectFindAndUpdate();
//
}If you are using Session Autentication it's possible to add the middleware IvanoMatteo\LaravelDeviceTracking\Http\Middleware\DeviceTrackerMiddleware in app/Http/Kernel.php, at the end of web group.
In this way, the device will be checked also for requests subsequents to the login request. DeviceTrackerMiddleware will store the md5( $device_uuid . $user_agent ) inside the session so the detection will be executed again only if the hash do not match
Following events could be emitted:
-
DeviceCreated
when a new device is detected and stored
-
DeviceUpdated
when some information of a device are changed
-
DeviceHijacked
when critical device information are changed. You ca also define a custom DeviceHijackingDetector. After this event, the device will be updated, and the next time, DeviceHijacked will not be emitted, but the device will have the field device_hijacked_at with the last DeviceHijacked event timestamp.
-
UserSeenFromNewDevice
when an user is detected on a device for the first time
-
UserSeenFromUnverifiedDevice
when an user is detected on a device not for the first time and the device is not flagged as verified
Please see CHANGELOG for more information what has changed recently.
Please see CONTRIBUTING for details.
If you discover any security related issues, please email [email protected] instead of using the issue tracker.
The MIT License (MIT). Please see License File for more information.