# Confirm a password before a sensitive Vue action

> password.confirm sends the user to Fortify's confirm screen. The Vue form posts the current password once.

- URL: https://laravel-vuejs.space/fortify-confirm-password-vue
- Author: Anass Ez-zouaine (https://laravel-vuejs.space/author/anass-ez-zouaine)
- Published: 2026-10-11
- Topics: Laravel, VueJs

People searching “Fortify confirm password Vue” ask for the password on every request from the Vue page. Laravel already has a timeout for this. Put `password.confirm` on the route that changes the email or deletes the account. The [Fortify guide](https://laravel-vuejs.space/laravel-fortify-vue) covers the login POST these screens sit behind.

> **TL;DR**
>
> -   password.confirm sends the user to Fortify’s confirm screen.
> -   The Vue form posts the current password once.
> -   Do not store “the user confirmed” in `localStorage`.
> -   Do not skip the middleware because the Vue button already asked.
>
> **Who it's for:** Laravel + Vue developers
>
> **Applies to:** Laravel 13 · Vue 3

## The fix

```php
Route::delete('/account', [AccountController::class, 'destroy'])
    ->middleware(['auth', 'password.confirm']);
```

When the confirmation has expired, Laravel redirects to the confirm screen. The kit page is `resources/js/pages/auth/ConfirmPassword.vue`. It posts the current password:

```ts
form.post("/user/confirm-password");
```

One field, named `password`. This is the current password, not a new one, and it does not use `password_confirmation`.

## What to avoid

> **Gotcha**
>
> Do not store “the user confirmed” in `localStorage`. The timeout lives in the session. A stolen page script should not be able to refresh it. Do not skip the middleware because the Vue button already asked. The button is not the check.

## FAQ

**Q: How do I confirm a password before a sensitive Vue action?**

password.confirm sends the user to Fortify's confirm screen. The Vue form posts the current password once.

**Q: What goes wrong with Fortify confirm password Vue?**

Many developers ask for the password on every request from the Vue page. Do not store "the user confirmed" in `localStorage`.