Email verification in Laravel - Step-by-Step Execution

Concept Flow - Email verification

User registers with email

↓

System sends verification email

↓

User clicks verification link

↓

System checks token validity

↓

Allow access to protected areas

This flow shows how Laravel sends a verification email after registration, then verifies the user when they click the link.

Execution Sample

Laravel

use Illuminate\Auth\Events\Verified;
use Illuminate\Http\Request;
use Illuminate\Foundation\Auth\EmailVerificationRequest;

Route::get('/email/verify/{id}/{hash}', function (EmailVerificationRequest $request) {
    $request->fulfill();
    event(new Verified($request->user()));
    return redirect('/home');
})->middleware(['auth', 'signed'])->name('verification.verify');

This route handles the email verification link, marks the user as verified, triggers an event, and redirects.

Execution Table

Step	Action	Input/Condition	Result	Next Step
1	User clicks verification link	URL with id and hash	Request received with user and token	Check token validity
2	Check token validity	Token matches user and signed URL	Valid token	Call fulfill()
3	Call fulfill()	Mark user email_verified_at	User marked as verified	Trigger Verified event
4	Trigger Verified event	User verified	Event dispatched	Redirect to /home
5	Redirect	User verified	User sent to /home page	End
6	If token invalid	Token mismatch or expired	Show error or resend link	End

💡 Execution stops after redirect or error shown due to invalid token.

Variable Tracker

Variable	Start	After Step 2	After Step 3	Final
user->email_verified_at	null	null	timestamp set	timestamp set
request->valid_token	false	true	true	true
event_dispatched	false	false	true	true

Key Moments - 3 Insights

Why does the verification link include a hash and id?

The hash and id ensure the link is unique and secure. Step 2 in the execution_table shows the system checks the token validity using these values.

What happens if the user clicks an expired or tampered link?

Step 6 in the execution_table shows that if the token is invalid, the system shows an error or offers to resend the verification email.

How does Laravel mark the email as verified?

Step 3 calls fulfill(), which sets the user's email_verified_at timestamp, marking the email as verified.

Visual Quiz - 3 Questions

Look at the execution_table, what is the result after Step 3?

A Verification link sent

B User redirected to /home

C User marked as verified

D Error shown for invalid token

💡 Hint

Check the 'Result' column for Step 3 in the execution_table.

At which step does the system redirect the user to the home page?

A Step 5

B Step 4

C Step 2

D Step 6

💡 Hint

Look at the 'Action' and 'Next Step' columns in the execution_table for the redirect.

If the token is invalid, what does the system do according to the execution_table?

A Redirects to /home

B Shows error or resend link

C Marks user as verified

D Triggers Verified event

💡 Hint

See Step 6 in the execution_table under 'Result'.

Concept Snapshot

Email verification in Laravel:
- User registers with email
- System sends signed verification link
- User clicks link with id and hash
- Laravel checks token validity
- If valid, marks email_verified_at timestamp
- Fires Verified event
- Redirects user to home
- If invalid, shows error or resend option

Full Transcript

In Laravel email verification, after a user registers, the system sends a signed verification link containing the user's id and a hash. When the user clicks this link, Laravel receives the request and checks if the token is valid by matching the id and hash. If valid, Laravel calls fulfill() to mark the user's email as verified by setting the email_verified_at timestamp. It then triggers a Verified event and redirects the user to the home page. If the token is invalid or expired, Laravel shows an error or offers to resend the verification email. This process ensures only users with access to the email can verify and access protected parts of the app.

Practice

1. What is the main purpose of email verification in Laravel?

easy

A. To reset the user's password automatically

B. To delete unverified user accounts immediately

C. To log the user out after registration

D. To confirm a user's email address for security and trust

Solution

1. Step 1: Understand email verification purpose

   Email verification ensures the user owns the email they provided.

2. Step 2: Identify security benefits

   This process improves security and trust by confirming email validity.

3. Final Answer:

   To confirm a user's email address for security and trust -> Option D

4. Quick Check:

   Email verification = Confirm email ownership [OK]

Hint: Email verification confirms user email ownership [OK]

Common Mistakes:

• Confusing email verification with password reset
• Thinking it logs out users automatically
• Assuming it deletes accounts immediately

2. Which interface must the User model implement to enable email verification in Laravel?

easy

A. Illuminate\Contracts\Auth\MustVerifyEmail

B. Illuminate\Contracts\Auth\Authenticatable

C. Illuminate\Contracts\Auth\CanResetPassword

D. Illuminate\Contracts\Auth\Access\Authorizable

Solution

1. Step 1: Identify the required interface for email verification

   Laravel requires the User model to implement MustVerifyEmail to enable verification.

2. Step 2: Confirm the correct namespace and interface

   The interface is Illuminate\Contracts\Auth\MustVerifyEmail.

3. Final Answer:

   Illuminate\Contracts\Auth\MustVerifyEmail -> Option A

4. Quick Check:

   User model implements MustVerifyEmail [OK]

Hint: Use MustVerifyEmail interface on User model [OK]

Common Mistakes:

• Using Authenticatable instead of MustVerifyEmail
• Confusing with password reset interfaces
• Missing the correct namespace

3. Given this route setup in Laravel:

Route::middleware(['auth', 'verified'])->get('/dashboard', function () {
    return 'Welcome to your dashboard!';
});

What happens if a logged-in user tries to access /dashboard without verifying their email?

medium

A. They are redirected to the email verification notice page

B. They see the dashboard content immediately

C. They get a 404 Not Found error

D. They are logged out automatically

Solution

1. Step 1: Analyze middleware effects

   The 'verified' middleware checks if the user's email is verified before allowing access.

2. Step 2: Determine behavior for unverified users

   If not verified, Laravel redirects them to the verification notice page.

3. Final Answer:

   They are redirected to the email verification notice page -> Option A

4. Quick Check:

   'verified' middleware redirects unverified users [OK]

Hint: Middleware 'verified' redirects unverified users [OK]

Common Mistakes:

• Assuming unverified users see dashboard content
• Expecting a 404 error instead of redirect
• Thinking users get logged out automatically

4. Consider this User model snippet:

class User extends Authenticatable
{
    // Missing implementation here
}

Why might email verification fail to work properly with this model?

medium

A. Because the model does not use the Notifiable trait

B. Because the model does not implement MustVerifyEmail interface

C. Because the model lacks a 'verified' attribute

D. Because the model extends Authenticatable instead of Model

Solution

1. Step 1: Check interface implementation

   Email verification requires the User model to implement MustVerifyEmail interface.

2. Step 2: Identify missing implementation

   The snippet lacks this interface, so verification won't trigger properly.

3. Final Answer:

   Because the model does not implement MustVerifyEmail interface -> Option B

4. Quick Check:

   Missing MustVerifyEmail causes verification failure [OK]

Hint: Implement MustVerifyEmail to enable verification [OK]

Common Mistakes:

• Thinking extending Authenticatable is wrong
• Assuming 'verified' attribute is required manually
• Believing Notifiable trait controls verification

5. You want to customize the email verification process to send a verification email immediately after user registration. Which Laravel feature should you use to trigger this email automatically?

hard

A. Override the User model's boot method to send the email

B. Manually call the sendEmailVerificationNotification method in the controller

C. Use the Registered event and listen to it to send the verification email

D. Add a middleware to send the email on every request

Solution

1. Step 1: Identify Laravel's event system for registration

   Laravel fires a Registered event after user registration.

2. Step 2: Use event listener to send verification email

   Listening to Registered event allows sending the verification email automatically.

3. Final Answer:

   Use the Registered event and listen to it to send the verification email -> Option C

4. Quick Check:

   Registered event triggers verification email [OK]

Hint: Listen to Registered event to send verification email [OK]

Common Mistakes:

• Calling sendEmailVerificationNotification manually in controller
• Overriding boot method unnecessarily
• Using middleware to send email on every request