Laravel 5.4: Password reset token custom length?

Question

I am using laravel 5.4 building an API where I email the user a token on password reset if user verified, which user provides before resetting password. Currently the sent token has 64 characters and too large for user to grab, and I'm not sure if laravel has configuration to give a custom length to token?

Desh901 Desh901 · Accepted Answer · 2017-10-03T14:23:13

The solution is a little bit tricky, ill try to explain the procedure as clearly as possible:

STEP 1 - Extend the standard DatabaseTokenRepository

Create a class that extends Illuminate\Auth\Passwords\DatabaseTokenRepository in order to define a new token creation policy.

<?php

namespace App\Auth\Passwords;

use Illuminate\Auth\Passwords\DatabaseTokenRepository;

class CustomDatabaseTokenRepository extends DatabaseTokenRepository
{

    // Overrides the standard token creation function
    public function createNewToken()
    {
        retrun substr(parent::createNewToken(), 0, 30);
    }

}

I've just trimmed the token generated by Laravel down to 30 chars, feel free to implement your own token generation routine.

STEP 2 - Extend the standard PasswordBrokerManager

Now you have to tell the PasswordBrokerManager to use your token repository instead of the standard one. In order to do so you have to extend the class Illuminate\Auth\Passwords\PasswordBrokerManager.

<?php

namespace App\Auth\Passwords;

use Illuminate\Auth\Passwords\PasswordBrokerManager;

class CustomPasswordBrokerManager extends PasswordBrokerManager
{

    // Override the createTokenRepository function to return your
    // custom token repository instead of the standard one
    protected function createTokenRepository(array $config)
    {
        $key = $this->app['config']['app.key'];

        if (Str::startsWith($key, 'base64:')) {
            $key = base64_decode(substr($key, 7));
        }

        $connection = isset($config['connection']) ? $config['connection'] : null;

        return new CustomDatabaseTokenRepository(
            $this->app['db']->connection($connection),
            $this->app['hash'],
            $config['table'],
            $key,
            $config['expire']
        );
    }

}

STEP 3 - Extend the standard PasswordResetServiceProvider

Now you have to extend the standard Illuminate\Auth\Passwords\PasswordResetServiceProvider in order to tell Laravel to instantiate your CustomPasswordBrokerManager.

<?php

namespace App\Auth\Passwords;

use Illuminate\Auth\Passwords\PasswordResetServiceProvider;

class CustomPasswordResetServiceProvider extends PasswordResetServiceProvider
{

    // Override the method registerPasswordBroker
    // in order to specify your customized manager
    protected function registerPasswordBroker()
    {
        $this->app->singleton('auth.password', function ($app) {
            return new CustomPasswordBrokerManager($app);
        });

        $this->app->bind('auth.password.broker', function ($app) {
            return $app->make('auth.password')->broker();
        });
    }
}

STEP 4 - Final step, replace the provider in config/app.php

Comment out the following line in your config/app.php files under the providers key:

// Illuminate\Auth\Password\PasswordResetServiceProvider::class,

And add the following line just below:

App\Auth\Passwords\CustomPasswordResetServiceProvider::class,

CONSIDERATIONS

Be careful when doing such things, the token is defined as hash_hmac('sha256', Str::random(40), $this->hashKey) where $this->hasKey is env('APP_KEY). This is used to ensure that no collision will occur when generating password reset tokens. I suggest you to investigate a secure method to reduce your token length securely.

Laravel 5.4: Password reset token custom length?

1 Answers