Weave Code
Http Hmac Php Laravel Package
acquia/http-hmac-php
PHP implementation of HTTP HMAC authentication for securing service-to-service API requests. Sign and verify requests using shared secrets, with support for PSR-7 and framework request objects, making it easy to add tamper-resistant authentication to PHP applications.
An implementation of the HTTP HMAC Spec in PHP that integrates with popular libraries such as Symfony and Guzzle.
Frequently asked questions about Http Hmac Php
- Is acquia/http-hmac-php a Laravel package?
- No. acquia/http-hmac-php is a PSR-7 request and response signing library that implements the HTTP HMAC specification; it ships no Laravel service provider, facade, publishable config, or artisan command. Adopting it in Laravel means adding the Composer dependency and owning a thin integration layer, typically a Guzzle middleware for outbound calls and a middleware for inbound verification.
- How do I install acquia/http-hmac-php in a Laravel application?
- Run composer require acquia/http-hmac-php. The runtime footprint is essentially psr/http-message ^1.0 || ^2.0 and ext-hash, both already satisfied by Laravel 9, 10, and 11 with Guzzle 7. There is no database, queue, cache, migration, or config publication step, so installation is a dependency bump plus your own wiring.
- Which PHP and Laravel versions does acquia/http-hmac-php support?
- Laravel 9, 10, and 11 on PHP 8.1+ are a clean fit because Guzzle 7 and psr/http-message ^2.0 are already present. Laravel 8 on PHP 7.4 technically works but is EOL upstream, and PHP 7.3 is a hard block since the package requires PHP 7.4 or newer. Note that the current release's CI explicitly covers PHP 7.4, 8.4, and 8.5, so 8.0 through 8.3 are covered by inference rather than direct evidence.
- How do I sign outbound Laravel HTTP requests with HMAC?
- Add a Guzzle middleware in front of Laravel's Http client or a dedicated client factory instance and sign each request with the library's signer and your shared secret. The package's AuthorizationHeaderBuilder and RequestSigner classes are the usual seam. Keep the set of signed endpoints explicit and enumerated, because a partial rollout is harder to reason about than a bounded one.
- How do I verify incoming HMAC requests in Laravel?
- Use a middleware that converts the incoming Symfony request to PSR-7 and verifies the signature with the library's verification primitives before your controller runs. Reject unsigned or invalid requests with a 401 and log enough context to debug key ID and clock skew issues. The package gives you the HMAC mechanics, but wiring the guard-style middleware and failure responses is your code.
- Does acquia/http-hmac-php integrate with Guzzle and Symfony?
- Yes, that is the library's main purpose. It integrates with Guzzle for outbound signing and with Symfony request and response objects, and it works with PSR-7 messages. Those integrations are why it drops into a Laravel HTTP client stack without requiring framework-specific code.
- Who handles shared secret storage and key rotation for HMAC authentication?
- Secret storage and rotation are yours to own; the package has no key management, database, or config layer. That includes distributing shared secrets and key IDs across dev, staging, production, and regions, plus defining how old keys are retired. Plan this before rollout, because it is usually the most under-scoped part of an HMAC integration.
- Does HTTP HMAC authentication protect against replay attacks and clock skew?
- The HTTP HMAC specification uses nonce and timestamp values, but replay protection depends on the receiving side actually enforcing them. Confirm what clock skew your verifier tolerates and whether nonces are stored long enough to reject duplicates. The library gives you signing and verification building blocks; the replay policy and storage are application concerns.
- What are the PHP 8.4 deprecation risks when upgrading acquia/http-hmac-php?
- Release 6.2.0 was an infrastructure release: minimum PHP moved to 7.4, implicitly nullable parameters gained explicit ?Type hints for PHP 8.4 deprecations, and CI moved to GitHub Actions. Callers are source-compatible, but if you subclass AuthorizationHeaderBuilder, RequestSigner, ResponseSigner, HmacToken, HmacAuthenticationEntryPoint, or the Malformed exception classes, mirror the nullable hints or you may hit deprecation failures. The exception subclasses are easy to miss because happy-path tests never instantiate them.
- What alternatives to acquia/http-hmac-php should I consider for Laravel?
- For user authentication, use Laravel's built-in auth, Sanctum, or Passport rather than HMAC. For service-to-service calls with an OAuth or OIDC identity provider, a token flow may be a better fit; choose this library when counterparties specifically mandate the HTTP HMAC spec. It is Acquia-maintained with community support, no SLA, and no Laravel-facing documentation, so compare the permanent glue-code ownership against alternatives before committing.
Weaver
How can I help you explore Laravel packages today?