Email verification in Laravel

Introduction

Email verification helps confirm that a user owns the email they provide. It improves security and trust by making sure users are real.

When users register on your website and you want to confirm their email address.

To prevent fake or spam accounts from being created.

Before allowing users to access certain features that require verified contact info.

When you want to send important notifications only to verified users.

Syntax

Laravel

use Illuminate\Contracts\Auth\MustVerifyEmail;

class User extends Authenticatable implements MustVerifyEmail
{
    // User model code
}

Implementing the MustVerifyEmail interface on your User model enables email verification features.

Laravel automatically sends a verification email when a user registers if this interface is used.

Examples

This example shows how to add email verification to the User model by implementing the MustVerifyEmail interface.

Laravel

<?php

namespace App\Models;

use Illuminate\Foundation\Auth\User as Authenticatable;
use Illuminate\Contracts\Auth\MustVerifyEmail;

class User extends Authenticatable implements MustVerifyEmail
{
    // User model code
}

This example shows the routes needed to handle email verification notices, verification links, and resending verification emails.

Laravel

<?php

// In routes/web.php

use Illuminate\Foundation\Auth\EmailVerificationRequest;
use Illuminate\Http\Request;

Route::get('/email/verify', function () {
    return view('auth.verify-email');
})->middleware('auth')->name('verification.notice');

Route::get('/email/verify/{id}/{hash}', function (EmailVerificationRequest $request) {
    $request->fulfill();
    return redirect('/home');
})->middleware(['auth', 'signed'])->name('verification.verify');

Route::post('/email/verification-notification', function (Request $request) {
    $request->user()->sendEmailVerificationNotification();
    return back()->with('message', 'Verification link sent!');
})->middleware(['auth', 'throttle:6,1'])->name('verification.send');

Sample Program

This complete example shows how to enable email verification in Laravel by updating the User model and defining the necessary routes. When a user registers, Laravel sends a verification email automatically. The user visits the verification link to confirm their email.

Laravel

<?php

// User.php (Model)

namespace App\Models;

use Illuminate\Foundation\Auth\User as Authenticatable;
use Illuminate\Contracts\Auth\MustVerifyEmail;

class User extends Authenticatable implements MustVerifyEmail
{
    // User model code
}

// routes/web.php

use Illuminate\Foundation\Auth\EmailVerificationRequest;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Route;

Route::get('/email/verify', function () {
    return 'Please verify your email address.';
})->middleware('auth')->name('verification.notice');

Route::get('/email/verify/{id}/{hash}', function (EmailVerificationRequest $request) {
    $request->fulfill();
    return 'Email verified successfully!';
})->middleware(['auth', 'signed'])->name('verification.verify');

Route::post('/email/verification-notification', function (Request $request) {
    $request->user()->sendEmailVerificationNotification();
    return 'Verification link sent!';
})->middleware(['auth', 'throttle:6,1'])->name('verification.send');

Important Notes

Make sure your User model uses the MustVerifyEmail interface to enable verification.

Laravel's built-in email verification uses signed URLs to secure verification links.

Use middleware like 'auth' and 'signed' to protect verification routes.

Summary

Email verification confirms a user's email to improve security.

Implement MustVerifyEmail on the User model to enable it.

Set up routes to handle verification notices, verification links, and resending emails.

Practice

1. What is the main purpose of email verification in Laravel?

easy

A. To reset the user's password automatically

B. To delete unverified user accounts immediately

C. To log the user out after registration

D. To confirm a user's email address for security and trust

Solution

1. Step 1: Understand email verification purpose

   Email verification ensures the user owns the email they provided.

2. Step 2: Identify security benefits

   This process improves security and trust by confirming email validity.

3. Final Answer:

   To confirm a user's email address for security and trust -> Option D

4. Quick Check:

   Email verification = Confirm email ownership [OK]

Hint: Email verification confirms user email ownership [OK]

Common Mistakes:

• Confusing email verification with password reset
• Thinking it logs out users automatically
• Assuming it deletes accounts immediately

2. Which interface must the User model implement to enable email verification in Laravel?

easy

A. Illuminate\Contracts\Auth\MustVerifyEmail

B. Illuminate\Contracts\Auth\Authenticatable

C. Illuminate\Contracts\Auth\CanResetPassword

D. Illuminate\Contracts\Auth\Access\Authorizable

Solution

1. Step 1: Identify the required interface for email verification

   Laravel requires the User model to implement MustVerifyEmail to enable verification.

2. Step 2: Confirm the correct namespace and interface

   The interface is Illuminate\Contracts\Auth\MustVerifyEmail.

3. Final Answer:

   Illuminate\Contracts\Auth\MustVerifyEmail -> Option A

4. Quick Check:

   User model implements MustVerifyEmail [OK]

Hint: Use MustVerifyEmail interface on User model [OK]

Common Mistakes:

• Using Authenticatable instead of MustVerifyEmail
• Confusing with password reset interfaces
• Missing the correct namespace

3. Given this route setup in Laravel:

Route::middleware(['auth', 'verified'])->get('/dashboard', function () {
    return 'Welcome to your dashboard!';
});

What happens if a logged-in user tries to access /dashboard without verifying their email?

medium

A. They are redirected to the email verification notice page

B. They see the dashboard content immediately

C. They get a 404 Not Found error

D. They are logged out automatically

Solution

1. Step 1: Analyze middleware effects

   The 'verified' middleware checks if the user's email is verified before allowing access.

2. Step 2: Determine behavior for unverified users

   If not verified, Laravel redirects them to the verification notice page.

3. Final Answer:

   They are redirected to the email verification notice page -> Option A

4. Quick Check:

   'verified' middleware redirects unverified users [OK]

Hint: Middleware 'verified' redirects unverified users [OK]

Common Mistakes:

• Assuming unverified users see dashboard content
• Expecting a 404 error instead of redirect
• Thinking users get logged out automatically

4. Consider this User model snippet:

class User extends Authenticatable
{
    // Missing implementation here
}

Why might email verification fail to work properly with this model?

medium

A. Because the model does not use the Notifiable trait

B. Because the model does not implement MustVerifyEmail interface

C. Because the model lacks a 'verified' attribute

D. Because the model extends Authenticatable instead of Model

Solution

1. Step 1: Check interface implementation

   Email verification requires the User model to implement MustVerifyEmail interface.

2. Step 2: Identify missing implementation

   The snippet lacks this interface, so verification won't trigger properly.

3. Final Answer:

   Because the model does not implement MustVerifyEmail interface -> Option B

4. Quick Check:

   Missing MustVerifyEmail causes verification failure [OK]

Hint: Implement MustVerifyEmail to enable verification [OK]

Common Mistakes:

• Thinking extending Authenticatable is wrong
• Assuming 'verified' attribute is required manually
• Believing Notifiable trait controls verification

5. You want to customize the email verification process to send a verification email immediately after user registration. Which Laravel feature should you use to trigger this email automatically?

hard

A. Override the User model's boot method to send the email

B. Manually call the sendEmailVerificationNotification method in the controller

C. Use the Registered event and listen to it to send the verification email

D. Add a middleware to send the email on every request

Solution

1. Step 1: Identify Laravel's event system for registration

   Laravel fires a Registered event after user registration.

2. Step 2: Use event listener to send verification email

   Listening to Registered event allows sending the verification email automatically.

3. Final Answer:

   Use the Registered event and listen to it to send the verification email -> Option C

4. Quick Check:

   Registered event triggers verification email [OK]

Hint: Listen to Registered event to send verification email [OK]

Common Mistakes:

• Calling sendEmailVerificationNotification manually in controller
• Overriding boot method unnecessarily
• Using middleware to send email on every request