- How do I install aporat/laravel-auth-signature in Laravel?
- Install it with composer require aporat/laravel-auth-signature and let Laravel package discovery register the service provider. Then publish and edit the package config to set your client ID and shared secret. The package is configured through config and the service provider, so you do not need to write manual signing code on both sides.
- How do I sign outgoing Laravel HTTP client requests with HMAC?
- Use the Http::withSignature() macro on Laravel's HTTP client to sign outbound requests at send time. It reuses SignatureGenerator, so the headers it produces should verify against the ValidateAuthSignature middleware when both sides share the same client ID and secret. Configure credentials before making the call and confirm the receiving route uses the middleware.
- How does the Laravel auth signature middleware validate incoming requests?
- Add the ValidateAuthSignature middleware to API routes or route groups that should reject unsigned or tampered requests. The middleware validates the signature headers against the configured secret and lets valid requests continue. Keep client and server configuration aligned so the canonical string and credentials match.
- Why does signature validation return HTTP 500 instead of 401 or 403?
- Signature failures can surface as HTTP 500 because the host application must map the package's exceptions in bootstrap/app.php. Treat that mapping as a required integration step and render signature or authentication failures as 401 or 403. Without it, failed authentication pollutes error budgets and looks like a server fault to clients.
- What Laravel and PHP versions does aporat/laravel-auth-signature support?
- The provided notes do not confirm the official Laravel and PHP runtime matrix, so check the package composer.json and upstream README before adopting it. The PHPUnit ^11 || ^12 change concerns dev tooling, not necessarily supported runtime versions. Pin versions in your app and run an integration test on your target Laravel and PHP combination.
- Does aporat/laravel-auth-signature protect against replay attacks?
- Replay protection is limited to the timestamp window of roughly plus or minus 300 seconds; the package does not describe a nonce or idempotency store. That is usually acceptable for low-risk internal APIs over TLS, but high-value or replay-sensitive operations need an additional nonce or replay cache. Do not treat the timestamp check alone as full replay protection.
- Can I use auth-signature:sign to debug signature mismatches?
- Yes. The auth-signature:sign Artisan command can generate headers, a ready-to-use curl command, and canonical-string debug output. Use it to compare expected headers and canonical strings against any existing custom signing implementation. This shortens debugging when a signature verifies locally but fails at the middleware.
- Is Http::withSignature safe with Laravel HTTP client retries?
- The package signs outgoing requests at send time through Http::withSignature(), but retry behavior is not explicitly documented in the provided notes. If you use Laravel's retry() helper, test that each attempt carries fresh signature headers and a current timestamp. Verify the receiving middleware accepts retried requests before relying on it in production.
- Can I use the package with Guzzle or PSR-7 instead of Laravel's HTTP client?
- RequestSigner supports PSR-7 requests, so Guzzle-oriented code can use the signing logic outside Laravel's HTTP client. The package still depends on Illuminate HTTP, routing, console, and Guzzle, so it is less attractive for minimal non-Laravel PHP services. It fits best when both sides are Laravel or PHP services.
- Does aporat/laravel-auth-signature include tests I can run from vendor?
- The published Composer artifact no longer includes tests, CI configuration, or dev tooling, so you cannot run the package's own suite from vendor. Rely on upstream CI and add your own end-to-end route tests for signing and validation. Test exception mapping, timestamp handling, and retry behavior in your application.