The Php Times

Email Magic Link for Laravel is a passwordless authentication package that enables user sign-in through emailed links or one-time codes. The package works independently or alongside Laravel Fortify and requires no additional runtime dependencies beyond the framework itself.

The package addresses a critical security vulnerability in traditional magic link flows: email scanners and security appliances often pre-fetch URLs before users see them, consuming single-use tokens automatically. Email Magic Link solves this by splitting the flow into two steps—the GET request only renders a confirmation page, while the actual token consumption happens through an explicit POST from that page, which scanners cannot trigger. Tokens and codes are stored only as keyed HMAC-SHA256 hashes, never in plaintext, with per-token brute-force lockout (maximum 5 attempts by default) and race-free consumption logic.

When users have two-factor authentication enabled via Fortify, verifying a magic link does not automatically authenticate them. Instead, they are routed to Fortify's two-factor challenge as unauthenticated users, preventing any bypass scenarios. For SPA and mobile clients, JSON responses indicate whether users need two-factor verification or are fully authenticated.

Developers can issue links and codes programmatically without sending them automatically, enabling custom delivery through SMS, push notifications, or custom mailables via the EmailMagicLink facade. The package includes a ResendGuard to prevent abuse, applying escalating cooldowns (30 seconds, 60 seconds, 120 seconds) plus a rolling five-sends-per-hour cap. A scheduled command automatically purges expired tokens daily.

The package requires PHP 8.4 and Laravel 13, with Fortify as an optional dependency. Installation involves running `composer require pushery/email-magic-link-for-laravel`, followed by the install command and database migrations.