Laravel Authentication 13

Apply the Laravel 13 prompt first. These additional rules cover guards, providers, password recovery, email verification, policy bypasses, and optional Fortify, Sanctum, and Socialite integrations. Apply package-specific rules only when that package is used.

Guards and credential decisions

• Bind each route to its intended guard with auth:<guard> and resolve the user through that guard. Align config/auth.php providers with fortify.guard and fortify.passwords; Fortify requires a StatefulGuard. Never select guards or providers from arbitrary request input.
• Pass an explicit credential allowlist to Auth::attempt() with the submitted plaintext password; add account-status or tenant conditions from trusted server state, or use attemptWhen(). Do not pass the entire request as credentials or pre-hash the submitted password.
• Enforce account disablement and tenant membership on authenticated requests as well as password login. Session restoration, remember-me authentication, Sanctum tokens, and passkey login do not rerun the conditions supplied to attempt().
• Restrict Auth::login(), loginUsingId(), onceUsingId(), and setUser() to identities established by a trusted authentication or authorized impersonation flow; these APIs do not verify a password or complete MFA. An identifier or a retrieved user model is insufficient proof.
• Keep custom UserProvider::retrieveByCredentials() separate from validateCredentials(), and implement rehashPasswordIfRequired(). A Fortify::authenticateUsing() callback must verify credentials and account