People searching “Laravel invite user Vue” create the user with a password and email the password. Send a signed link instead. The person sets a password when they arrive. Login itself stays the Fortify guide.
TL;DR
- Email a signed URL and store only a hash of the token.
- Do not email a temporary password.
- Do not put the raw token in the database.
- Do not put the invite URL behind an Inertia
<Link>in the email.
The fix#
$token = Str::random(32);
Invitation::create([
'email' => $validated['email'],
'token' => hash('sha256', $token),
'invited_by' => $request->user()->id,
]);
$url = URL::temporarySignedRoute(
'invites.accept',
now()->addDays(3),
['token' => $token],
);Mail $url. The accept route uses the signed middleware, hashes the token again, and finds the invitation. The Vue page on that route is a form for a name and a password. It is not a list of every user.
What to avoid#
Gotcha
Do not put the raw token in the database. Do not put the invite URL behind an Inertia <Link> in the email. The email is a normal <a href>. Do not skip signed because the token is long. The signature is what stops a edited query string.
FAQ#
How do I invite a teammate with a signed link?
Email a signed URL and store only a hash of the token. Do not email a temporary password.
What goes wrong with Laravel invite user Vue?
Many developers create the user with a password and email the password. Do not put the raw token in the database.
