Implement laravel-challenge.

app/Http/Kernel.php

@@ -33,6 +33,7 @@ class Kernel extends HttpKernel
             \Illuminate\Cookie\Middleware\AddQueuedCookiesToResponse::class,
             \Illuminate\Session\Middleware\StartSession::class,
             // \Illuminate\Session\Middleware\AuthenticateSession::class,
+            \BoxedCode\Laravel\Auth\Challenge\Http\Middleware\RequireAuthentication::class,
             \Illuminate\View\Middleware\ShareErrorsFromSession::class,
             \App\Http\Middleware\VerifyCsrfToken::class,
             \Illuminate\Routing\Middleware\SubstituteBindings::class,

app/User.php

@@ -2,13 +2,15 @@
 
 namespace App;
 
+use BoxedCode\Laravel\Auth\Challenge\Challengeable;
+use BoxedCode\Laravel\Auth\Challenge\Contracts\Challengeable as ChallengeableContract;
 use Illuminate\Contracts\Auth\MustVerifyEmail;
 use Illuminate\Foundation\Auth\User as Authenticatable;
 use Illuminate\Notifications\Notifiable;
 
-class User extends Authenticatable
+class User extends Authenticatable implements ChallengeableContract
 {
-    use Notifiable;
+    use Notifiable, Challengeable;
 
     /**
      * The attributes that are mass assignable.

composer.json

@@ -9,6 +9,7 @@
     "license": "MIT",
     "require": {
         "php": "^7.2.5",
+        "boxed-code/laravel-challenge": "~4.0",
         "fideloper/proxy": "^4.2",
         "fruitcake/laravel-cors": "^1.0",
         "guzzlehttp/guzzle": "^6.3",