---
title: "Replay protection — Two-Factor for Laravel | Roundly"
description: "Every accepted code claims its timestep atomically, so an intercepted code can’t be reused — tracked in a column, the cache or your own guard."
url: https://roundly-consulting.com/open-source/docs/two-factor-for-laravel/replay-protection
language: en
---

[All packages](https://roundly-consulting.com/open-source.md)

[Two-Factor for Laravel](https://roundly-consulting.com/open-source/docs/two-factor-for-laravel.md)

# Replay protection

Once a TOTP code is accepted, its timestep is claimed in a single check-and-set. Any code with a timestep at or before the last successful one is rejected and TwoFactorReplayDetected fires with that timestep — so two concurrent submissions of the same code cannot both succeed. The code used to confirm enrolment is claimed too.

## Choosing a guard

```php
// config/two-factor.php
'replay_guard' => 'cache',   // 'column' | 'cache' | 'none' (null → none)
'cache' => [
    'store' => env('TWO_FACTOR_CACHE_STORE'),
    'ttl' => 60 * 60 * 24,
],
```

| Mode | Guard | How it claims |
| --- | --- | --- |
| `column` | `ColumnReplayGuard` | The default — also what a blank replay\_guard resolves to. One conditional UPDATE on the last-used-timestep column; zero affected rows means a replay. Persists with the account row. |
| `cache` | `CacheReplayGuard` | Claims under the store’s atomic lock (Redis, Memcached, database, file and array all provide one), with a best-effort path for lock-less stores. |
| `none / null` | `NullReplayGuard` | Every claim succeeds — replay protection is off. |

If you choose the cache guard on a multi-node host, back it with an atomic store such as Redis or the database.

cache.ttl must outlive a valid code: at least (2 × window + 1) × period seconds, 90 with the defaults. A shorter value throws InvalidTwoFactorConfigException when the cache guard resolves — otherwise the entry would expire while the claimed code still verifies, and the same code would be accepted again.

## Cache guard caveat

A cache flush or eviction (cache:clear, a deploy, LRU pressure) drops the last-used timestep and momentarily reopens the replay window. Where that risk is unacceptable, use the default column guard, which persists to the account table.

## Custom guard

Bind your own implementation of the ReplayGuard contract to store timesteps elsewhere:

```php
// The contract — RoundlyConsulting\TwoFactor\Contracts\ReplayGuard
interface ReplayGuard
{
    // The latest recorded timestep (null when none yet).
    public function latestTimestep(TwoFactorAuthenticatable&Model $user): ?int;

    // Atomic check-and-set: true when newly claimed, false on a replay.
    public function claim(TwoFactorAuthenticatable&Model $user, int $timestep): bool;
}

// In a service provider's register():
$this->app->singleton(ReplayGuard::class, fn () => new MyReplayGuard);
```

## Show your open-source love

This package is free and MIT-licensed. If it saves you time, a one-off donation or a Patreon membership keeps it maintained, tested and documented.

[More ways to support, including crypto](https://roundly-consulting.com/support-us.md)

By donating, you agree to our [donation terms](https://roundly-consulting.com/donation-terms.md).

[Support our open source work (opens in a new tab)](https://donate.stripe.com/dRmeVe8FX5PF1Qd9pXcEw00) [Join us on Patreon (opens in a new tab)](https://www.patreon.com/cw/roundly)

## Want this built into your product?

We integrate our packages into custom Laravel and AI builds. Tell us what you're working on and we'll reply within 48 hours.

[Get a quote in 48 hours](https://roundly-consulting.com/contact.md) [Browse all packages](https://roundly-consulting.com/open-source/docs/two-factor-for-laravel.md)