> ## Content Index > Fetch the complete content index at: https://securinglaravel.com/llms.txt > Use this file to discover other available public pages before exploring further. # Security Tip: 2FA Isn't Just For Logins! - URL: https://securinglaravel.com/security-tip-2fa-isnt-just-for-logins/ - Published: 2025-08-09T01:28:11.000Z - Updated: 2025-08-09T03:08:39.000Z - Description: [Tip #118] Account passwords are easy to compromise, so why are you relying on them to verify users within your app? If your users log in with a 2FA Token, then they should be able to prove it before performing other sensitive activities too. - Author: Stephen Rees-Carter - Tags: Security Tips, MFA, Authentication Last time we took an In Depth look at [Setting Up Two-Factor Authentication](https://securinglaravel.com/in-depth-setting-up-two-factor-authentication/), and today I wanted to remind you that **MFA isn't just for your login flow!** *If you haven't yet read that article, do check it out. I'm incredibly proud of how much we covered!* Any time you want to authenticate that a legitimate user is performing a specific action, you can use one of your authentication factors. If you have multiple factors in your login flow, that gives you multiple options to use within the application too - not just your password! Consider the humble *Change Password* form: ![](https://storage.ghost.io/c/d9/0d/d90de76f-6031-4e2c-85b8-3447a38c4992/content/images/2025/08/image-1.png) Update Password form in Nightwatch. Right at the top, we're asked to confirm our *Current Password*. This is to check that we are the user of this account, and is designed to prevent an attacker from setting their own password during attacks like session hijacks or forgotten logouts on shared computers. We're all so accustomed to this pattern that we don't even think twice. Laravel even provides a [Password Confirmation](https://laravel.com/docs/authentication?ref=securinglaravel.com#password-confirmation) option, in the form of the `password.confirm` middleware. This gives us a trivial way to protect specific routes with an additional password confirmation challenge. We could stop here, but **this pattern could very easily be implemented for any of your other authentication factors too!** ## The essential security resource for Laravel developers. Sign up now to receive the [****weekly Laravel Security tips**](https://securinglaravel.com/tag/tips/) and [****monthly In Depth articles**](https://securinglaravel.com/tag/in-depth/) you need to keep your Laravel applications safe! Subscribe Email sent! Check your inbox to complete your signup. No spam. Unsubscribe anytime. Consider the confirmation we implemented when disabling 2FA in [our 2FA implementation](https://securinglaravel.com/in-depth-setting-up-two-factor-authentication/): ![](https://storage.ghost.io/c/d9/0d/d90de76f-6031-4e2c-85b8-3447a38c4992/content/images/2025/08/image-2.png) Disable 2FA Confirmation Dialog In order to disable 2FA, the user must first confirm that they have access to the existing 2FA token! This is done for the same reason you require the current password during a password change. **But why stop there?** You could ask the user to confirm their 2FA Token before all sorts of sensitive operations, such as: - Viewing and/or changing billing details - Changing account email address - Accessing admin tools - Accessing tenant configuration - User impersonation - Viewing PII or PHI - and many more... Account passwords are easy to compromise, so why are you relying on them to verify users within your app? If your users log in with a 2FA Token, then they should be able to prove it before performing other sensitive activities too. So don't just treat your 2FA as something that only happens during the login process, keep using it as a form of authentication! --- Securing Laravel is SPONSORED by... **Want to see your brand here?* [Find out more... ](https://securinglaravel.com/sponsor/) --- ***If you found this security tip useful?* 👍** [*Subscribe now*](#/portal/signup) *to get weekly* [***Security Tips***](https://securinglaravel.com/tag/tips/) *straight to your inbox, filled with practical, actionable advice to help you build safer apps.* ***Want to learn more?* 🤓** *Upgrade to a* [*Premium Subscription*](#/portal/signup) *for exclusive monthly* [**In Depth* articles*](https://securinglaravel.com/tag/in-depth/)*, or support my work with a* [*one-off tip*](#/portal/support) *or* [*recurring Sponsorship*](https://securinglaravel.com/sponsor/)*! Your support directly funds my security work in the Laravel community.* 🥰 **Need a second set of eyes on your code?** *Book in a* [*Laravel Security Audit and Penetration Test*](https://stephenreescarter.net/laravel-security-audits-and-pentesting/?utm%5Fsource=securinglaravel.com) *today! I also offer budget-friendly* [*Security Reviews*](https://stephenreescarter.net/laravel-security-reviews/?utm%5Fsource=securinglaravel.com) *too.* *Finally, connect with me on* [*Bluesky*](https://bsky.app/profile/valorin.bsky.social?ref=securinglaravel.com)*, or* [*other socials*](https://pinkary.com/@valorin?ref=securinglaravel.com)*, and check out* [*Practical Laravel Security*](https://practicallaravelsecurity.com/?utm%5Fsource=securinglaravel.com)*, my interactive course designed to boost your Laravel security skills.*