[6.x] Frontend Elevated Sessions

[duncanmcclean]

We introduced the concept of "Elevated Sessions" in v6 (#11688), allowing you to prompt users for their password or a verification code before taking sensitive actions.

Until now, elevated sessions have only been available in the Control Panel. This PR brings them to the frontend, ahead of another PR I'm working on.

Note

I haven't added the RequireElevatedSession middleware to any routes yet but I'm planning to use it on another PR I'm working on. For testing purposes, I've added it to a random page in my sandbox app.

Elevated Session page

Before you can take certain actions, you'll be redirected to a Statamic-looking authentication page where you'll be asked to confirm your identity.

If necessary, you may provide a custom page by specifying the URL in the users.php config file and using the {{ user:elevated_session_form }} tag.

// config/statamic/users.php

'elevated_session_page' => '/auth/confirm-password',

{{ user:elevated_session_form }}

    {{ if errors }}
        <div class="bg-red-300 text-white p-2">
            {{ errors }}
                {{ value }}<br>
            {{ /errors }}
        </div>
    {{ /if }}

    {{ if method == "password_confirmation" }}
        <label>Password</label>
        <input type="password" name="password" />
    {{ /if }}

    {{ if method == "verification_code" }}
        <p>A verification code has been sent to your email.</p>
        <label>Verification Code</label>
        <input type="text" name="verification_code" />
        <a href="{{ resend_code_url }}">Resend code</a>
    {{ /if }}

    <button type="submit">Confirm</button>

{{ /user:elevated_session_form }}

The method variable indicates how the user should confirm their identity:

• password_confirmation - User should enter their password.
• verification_code - User doesn't have a password, so they should enter the verification code sent to their email.
• passkey - User requires a passkey to login. Note: Passkeys aren't currently supported on the frontend.

Users will be redirected back to the original page once they've confirmed their identity.

---

Docs PR: statamic/docs#1878