Confirm a password before a sensitive Vue action

password.confirm sends the user to Fortify's confirm screen. The Vue form posts the current password once.

1 min read

For your AI agent

Copies a prompt. Paste it into the AI agent you already have open.

Read https://laravel-vuejs.space/fortify-confirm-password-vue.md
password.confirm sends the user to Fortify's confirm screen. The Vue form posts the current password once.
Do not store "the user confirmed" in localStorage.
Do not skip the middleware because the Vue button already asked.
Show the diff. Do not commit.
On this page · 3 sections
  1. The fix
  2. What to avoid
  3. FAQ

People searching “Fortify confirm password Vue” ask for the password on every request from the Vue page. Laravel already has a timeout for this. Put password.confirm on the route that changes the email or deletes the account. The Fortify guide covers the login POST these screens sit behind.

TL;DR

  • password.confirm sends the user to Fortify’s confirm screen.
  • The Vue form posts the current password once.
  • Do not store “the user confirmed” in localStorage.
  • Do not skip the middleware because the Vue button already asked.

Who it's for: Laravel + Vue developers

Applies to: Laravel 13 · Vue 3

The fix#

php
Route::delete('/account', [AccountController::class, 'destroy'])
    ->middleware(['auth', 'password.confirm']);

When the confirmation has expired, Laravel redirects to the confirm screen. The kit page is resources/js/pages/auth/ConfirmPassword.vue. It posts the current password:

typescript
form.post("/user/confirm-password");

One field, named password. This is the current password, not a new one, and it does not use password_confirmation.

What to avoid#

Gotcha

Do not store “the user confirmed” in localStorage. The timeout lives in the session. A stolen page script should not be able to refresh it. Do not skip the middleware because the Vue button already asked. The button is not the check.

FAQ#

How do I confirm a password before a sensitive Vue action?

password.confirm sends the user to Fortify's confirm screen. The Vue form posts the current password once.

What goes wrong with Fortify confirm password Vue?

Many developers ask for the password on every request from the Vue page. Do not store "the user confirmed" in localStorage.

Found this useful?

Ask questions, share what you built.

Join thousands of Laravel and Vue developers in our Facebook group, or get new posts in your Telegram feed. Sharing this article helps too.

Join the Facebook group Follow on Telegram

Keep reading

Newsletter

Get the best of Laravel & Vue, once a month.

One short email with new guides, release notes worth reading and hand-picked community links. No spam, unsubscribe any time.

RSS feed Telegram channel