Sometimes, even if a user is currently signed in, you'll want them to reconfirm their password in order to proceed with some important action. For example, updating a subscription, or processing a payment, or changing a credit card, things like that. So let me show you how to do that in Laravel 6. I'm going to begin by pulling in Laravel UI. As we've learned, this will give us some basic scaffolding. Now if I view the help for this, we want to set up a Vue project as fine, it doesn't really matter here, and we'll also add the authentication scaffolding. Alright, UI, Vue, and add the auth scaffolding.

matter here, and we'll also add the authentication scaffolding. Alright, UI, Vue, and add the auth scaffolding. Alright, that's done. Let me go ahead and compile down the assets, and let's take a look. So now, in my resources directory, in the Vue folder, we'll have a password section here, and this is new in Laravel 6. A section to confirm your password. Next, what else is new? In your config directory, in the auth section, at the very bottom, you have the ability to specify when or how long a password confirmation should last.

In your config directory, in the auth section, at the very bottom, you have the ability to specify when or how long a password confirmation should last. In this case, 3 hours. So basically the way it works is, if you require a User to confirm their password, they will enter it once, and then will store it in the session for a default of 3 hours. Which means, if you try to perform that action again, within that span, we're not going to require a password again. You're good for the next 3 hours. But beyond that, you'll have to do it all over again. And that's fairly standard.

But beyond that, you'll have to do it all over again. And that's fairly standard. Okay, next, in your app/Http/Middleware directory, Kernel, you'll see a new route-specific middleware called password.confirm. So this means, if we attach this middleware to any route, it will require the user to enter their email address before accessing the underlying route. And again, once they do, they're good for 3 hours. Alright, so let's give this a shot. I'm going to go to my routes/web.php file. And real quick, you'll see right here, when we ran that php artisan ui command, it gave us some auth-specific

I'm going to go to my routes/web.php file. And real quick, you'll see right here, when we ran that php artisan ui command, it gave us some auth-specific routes. And in fact, I'll show you that with route:list. Alright, so by default, you get the password confirm endpoints. However, if you don't want those, if you don't plan on using it, you can always override it by saying confirm is false. So now, if we run it again, it won't generate those. And if you're curious about any other options, by the way, when you call this command, it's actually delegating to Laravel's Router class, and then specifically a method called auth.

And if you're curious about any other options, by the way, when you call this command, it's actually delegating to Laravel's Router class, and then specifically a method called auth. So here is where all of these routes are declared. So here, if you need password resets, or in our case, password confirmation. Okay, so here, a common use case would be before processing a payment or changing a credit card or anything like that. So let's simulate that by saying, let's say in the User's settings, maybe there's an option to edit their credit card. Okay, this will load, how about a SettingsCreditCardController and a method called edit.

Okay, this will load, how about a SettingsCreditCardController and a method called edit. Let's go ahead and create that controller. php artisan make:controller SettingsCreditCardController. And finally, if I open up that controller right down here, we'll add our edit method. Now, in this case, we're not really going to create a view to update a credit card. It's irrelevant here. So I will just say, show a form to edit the credit card. And you get the idea. So if we access that route, of course, we can see it because we have no protection in.

And you get the idea. So if we access that route, of course, we can see it because we have no protection in place. All right. Well, at the very least, we could add the auth middleware, which of course means you must be authenticated in order to access this route. So yeah, if we give that a refresh, it will redirect us to the login page. In this case, I already have a test user, so I will sign him in. And sure enough, we are redirected back to that page. So yes, he can access any of the routes that are behind that middleware.

And sure enough, we are redirected back to that page. So yes, he can access any of the routes that are behind that middleware. But yeah, again, we're deciding at some point if he adds something to his basket and he wants to check out. At some point there, we're going to reconfirm your password just to make sure it is you performing this action. So here's what we'll do. We could keep the auth middleware or password confirm will do the same thing effectively, or we can just stack them to be crystal clear. You must be signed in and you must confirm your password.

And if he comes back, it won't require a password again because he's all set for the next three hours. But if he does sign out, we'll do that here and signs back in. It should reset. Because, of course, the session is destroyed when you sign out. OK, let's do it one more time. Settings, card, edit, and it requires the password. Now, if you want to take a look at this, let's go to our CreditCardsController and we'll dd. There's actually a session helper here, and we can take a look at what's stored in the

die and dump. There's actually a session helper here, and we can take a look at what's stored in the session for auth. All right, give it a refresh. We can see for the current user session when they last confirmed their password. So check it if you want to dig a little bit lower and see how this is working. password.confirm. We can see that corresponds to this middleware. And if we go down to the handler, it's checking. Do we need to confirm the user's password again?

And if we go down to the handler, it's checking. Do we need to confirm the User's password again? It does that by getting the current time and subtracting whatever is in the session for password_confirm_done. So it's subtracting the current time from this, and it's checking. All right, well, is that greater than our timeout? In this case, three hours. Has it been more than three hours? If so, yep, it's time to reconfirm your password. So right here, it'll do a simple redirect guest.

If so, yep, it's time to reconfirm your password. So right here, it'll do a simple redirectGuest. So redirect to the password.confirm route. And you know that is this route here. And we're using, in this case, redirectGuest instead of redirect. And that's because it will redirect to that page, but it will also throw the currently requested route into the session. And that way, after that page, it'll send you to your intended location. And that way, you don't have to sign in again, and then it takes you back to the homepage, and then you have to return manually to where you originally wanted to go.

And that way, you don't have to sign in again, and then it takes you back to the homepage, and then you have to return manually to where you originally wanted to go. And lastly, if you're curious about that, don't forget to check your route file, and you'll see where we confirm the password. Here's the Route. Solaraville sets up. It delegates to a ConfirmPasswordController. Right here. And if we scroll down, first, of course, it requires that you're signed in. And then it actually delegates to a trait so that they can work on this and version.

And all that does is it throws the current time into the session. And that's it. So it's a mixture of this and then a middleware that reads that session and checks if it has been at least three hours. And that's about all there is to it. The only remaining note is a new validation rule called password. And that, we're getting a little off track here, but that will simply check the current password against what is stored for the current User. It'll just make sure that those match up. All right, so that's password confirmation in Laravel 6.

It'll just make sure that those match up. All right, so that's password confirmation in Laravel 6.