How to get the secret? about twofactor

[DarkGhostHunter]

How can I get the secret for use outside the Laravel application?

If you are wondering about the Shared Secret, you can easily get it from the user model relation itself. Pair that with a controller on a route and you can retrieve it.

use App\Models\User;

Route::get('user/{user:id}/shared_secret', function (User $user) {
    return $user->twoFactorAuth->shared_secret;
});

When passing in shared_secret to verify the 2fa code they gave it always returns false.

The Shared Secret is only given to the user once, at setup. After that, they need to confirm by generating a 2FA code on their device, which is returned to the app and checked against the code generated by the same server. If they're equal, it's true.

Route::get('user/{user:id}/confirm_2fa', function (User $user) {
    return $user->confirmTwoFactorAuth(request('2fa_code')); // true|false
});

Most common problems for this to fail are wrong server time and/or device time.

So how can I derive the secret from the shared_secret?

The shared_secret is encrypted on the database. Save yourself some lines and use the model itself from the first example to transmit it. It decrypts to a Base32 uppercased string.

Route::get('user/{user:id}/shared_secret', function (User $user) {
    return $user->twoFactorAuth->shared_secret;
});

[1e4]

I understand how to get it in Laravel, but I'm using it outside of Laravel, I looked at the internals but couldn't figure out how to get it from the database

[DarkGhostHunter]

You can just query the database and decrypt the shared secret. You should receive a Base 32 in uppercase string.

If you don't have the ID of the row, you will need to query both model class name and model id:

$secret = DB::table('two_factor_authentications')
    ->where([
        'authenticatable_type' => 'App/Models/User',
        'authenticatable_id' => 4
    ])
    ->first('shared_secret');

return Crypt::decrypt($secret);

[1e4]

Thanks, solved it. Now to understand why the session isn't being flashed which seems related to #21