phpreaction-frontend-login-react

Summary

• What it is: A centralized authentication frontend for PHPReaction that provides login, 2FA, password reset, and OAuth authorization entry points.
• Goal: Centralize authentication and SSO flows across PHPReaction frontends to reduce duplication and keep security implementation consistent.
• Repository: GitHub repository — https://github.com/PHPCreation/phpreaction-frontend-login-react 
• README (clone, run, repo Docker): README.md on default branch — https://github.com/PHPCreation/phpreaction-frontend-login-react/blob/main/README.md 
• Primary users: End users authenticating into PHPReaction apps, plus frontend teams integrating shared login/SSO flows.

Features

• Multi-tenant login experience with tenant-isolated auth handling.
• Username/password authentication with secure cookie session handling.
• Two-factor authentication (2FA) flow after primary authentication.
• Forgot/reset password flow with token-based reset.
• OAuth authorization flow support.
• CSRF protection on auth form submissions.
• reCAPTCHA integration for bot mitigation.
• Rate limiting for authentication endpoints and login attempts.
• Internationalization support (en, fr).
• Status pages for API/config/cache/token diagnostics.

Deployed environments

Multi-environment setup (react-doc) .

Integrations & dependencies

APIs

• Account API Link : https://TENANT.dev.account.solidservice.link/api/v1/docs 

  • dev : https://TENANT.dev.account.solidservice.link/api/v1 
  • staging : https://TENANT.staging.account.solidservice.link/api/v1 
  • prod : https://TENANT.account.solidservice.link/api/v1 

• Login Service Link : https://{tenant}.login.solidservice.link/

  • dev : https://{tenant}.dev.login.solidservice.link/
  • staging : https://{tenant}.staging.login.solidservice.link/
  • production : https://{tenant}.login.solidservice.link/

• OAuth Authorization Link : https://{tenant}.login.solidservice.link/authorize

• Google reCAPTCHA verification : https://www.google.com/recaptcha/api/siteverify

PHPR Bundles

• Authorization Bundle 
• Components Bundle 
• Config Bundle 
• CRUD Bundle 
• DynamoDB Bundle 
• Icons Bundle 
• Status Bundle 
• Utils Bundle 

Dependencies & Dependents Apps

• Dependencies : Apps and services that phpreaction-frontend-login-react uses

  • Login Service ({tenant}.login.solidservice.link)
  • OAuth service via /authorize
  • Google reCAPTCHA v3 verification API
  • Config API (for tenant/config-based runtime settings)
  • DynamoDB cache tables (App cache and Config cache)

• Dependents : Apps and services that use phpreaction-frontend-login-react

  • PHPReaction frontend applications requiring centralized login/SSO
  • Frontends redirecting users to login before protected app access

Routes

Main Routes :

• /[locale]/ : Login page.
• /[locale]/2fa : 2FA verification page.
• /[locale]/forgot-password : Forgot password request page.
• /[locale]/forgot-password/confirmation : Forgot password confirmation page.
• /[locale]/forgot-password/reset : Password reset form page.
• /[locale]/change-password : Change password page.
• /[locale]/confirm-email : Confirm email page.
• /[locale]/confirm-email/confirmation : Confirm email success page.
• /[locale]/security-check : Security check flow page.
• /[locale]/logout : Logout flow page.

Status Routes :

• /[locale]/status/all : List all status page.
• /[locale]/status/api : APIs status page.
• /[locale]/status/cache : Cache status page.
• /[locale]/status/configs : Configs status page.
• /[locale]/status/user-token/check : Checks if user token exists and is valid.
• /[locale]/status/user-token/display : Displays user token information.
• /[locale]/status/user-token/expected : Displays expected user token information

Support Routes :

• /[locale]/support : Support page.
• /config-error : Configuration error page.

Security implementation

• CSRF token validation on authentication and sensitive form endpoints.
• reCAPTCHA v3 verification on login, 2FA, and password reset endpoints.
• Rate limiting and cooldown controls for authentication requests.
• Input validation/sanitization (including URL parameter and return URL hardening).
• Open redirect protection for returnUrl handling.
• XSS prevention strategy with sanitization and strict validation.
• Content Security Policy (CSP) configuration and documentation.
• Token validation and refresh flow to protect authenticated sessions.

Related links

Repo

• Github 
• Issues, Features & Backlog 

Docs

• Internal doc 

• Client doc 

• Docker local setup 

• API Calls 

• Environment Variables 

• KVS 

• User Roles 

Compliance

• Security Checklist