Jwt Auth Bundle Laravel Package

⚠️ This is a beta release. It moves the bundle onto auth0-php v9, which rewrites the Management API. The Authentication API is unchanged. Please consult the 5.x to 6.x Upgrade Guide before upgrading.

🚀 What's New

This release makes the Auth0 Symfony SDK compatible with auth0-php v9. The bundle wraps the Authentication API, which is unchanged in v9, so authentication flows require no changes. The one source-level addition is a new, idiomatic entry point for the rewritten Management API.

✨ Highlights

• 🔑 New getManagement() accessor - Service::getManagement() returns a ManagementClient wrapper built from your existing bundle configuration (domain, client_id, client_secret), with automatic OAuth 2.0 client credentials token management and PSR-6 caching
• 🏗️ auth0-php v9 Management API - Strongly-typed requests and responses, sub-clients accessed as properties ($client->users->list()), and built-in Pager<T> pagination, all surfaced through the bundle
• 🛡️ Authentication API unchanged - The authenticator, authorizer, user provider, session store, and backchannel logout controller behave exactly as in 5.x

🔄 What's Changed

The Authentication surface is completely unchanged. Login, logout, callback, and token handling work exactly as before.

The Management API entry point has changed:

getSdk()->management() is non-functional with auth0-php v9 and throws a TypeError. Use getManagement() instead.

📦 Installation

composer require auth0/symfony:6.0.0-beta.0

🔧 Quick Start

use Auth0\SDK\API\Management\Users\Requests\ListUsersRequestParameters;
use Auth0\Symfony\Service;
use Symfony\Component\DependencyInjection\Attribute\Autowire;

// The bundle registers its service under the id `auth0`, so autowire it by id.
public function __construct(
    #[Autowire(service: 'auth0')]
    private Service $auth0,
) {
}

$management = $this->auth0->getManagement();

$users = $management->users->list(
    new ListUsersRequestParameters(['perPage' => 25])
);

foreach ($users as $user) {
    echo $user->getEmail();
}

⚠️ Breaking Changes

• Bumped the auth0/auth0-php dependency from ^8.19 to ^9.0
• Raised the minimum PHP version from 8.1 to 8.2
• getSdk()->management() is non-functional with auth0-php v9; use the new getManagement() accessor instead

📚 Resources

• 5.x to 6.x Upgrade Guide
• auth0-php v9 Migration Guide
• auth0-php v9 API Reference

🙏 Feedback

This is a beta release - we would love your feedback! Please open an issue if you encounter any problems or have suggestions.

Fixed

• Security fix: Resolve CVE-2026-50157

Fixed

• Security fix: Resolve CVE-2026-34236

Added

• feat: Add Symfony 8 support #230 (kishore7snehil), based on #221 by (NicolasDievart)

Fixed

• fix: correct .gitattributes #231 (kishore7snehil), based on #228 by (garak)

Fixed

• Security fix: Resolve CVE-2025-68129
• Fixed deprecated Request::get() methods to use explicit parameter bag methods for Symfony compatibility
• Resolved Psalm type inference error annotation to clarify mixed type handling from query parameters

Fixed

• Security fix: Resolve Resolve CVE-2025-58769

Fixed

• fix: Remove unused ext-json requirement from composer.json #209 (kishore7snehil)

Fixed

• Security fix: Resolve CVE-2025-47275

Fixed

• fix : Unit Tests #200 (kishore7snehil)
• Removed Deprecated Rules From PHP CS Fixer #195 (kishore7snehil)

This release includes experimental community-contributed support for Symfony 7. If you encounter any issues, please open an issue on GitHub.

Added

• Support for Symfony 7. #188 (mkilmanas)
• Support string concatenation of scopes. #183 (mkilmanas)

Changed

• Dashes in JWT permissions/scopes are now normalized. #184 (mkilmanas)

Fixed

• Fixed an issue in controller constructors using a $container argument. #190 (mkilmanas)

Fixed

• Syntax typo in AuthenticationController::__construct() #180 (mkilmanas)
• Controller container property assignment #179 (mkilmanas)

Changed

• Disallow installation with Symfony 7.0 until fully compatible

Fixed

• Restore method signatures #174 (evansims)

Added

• Implement support for Back-Channel Logout #167 (evansims) ¹

Changed

• Bumped auth0-php dependency version range to ^8.10.
• Raised the minimum supported PHP version to 8.1.
• Added support for Symfony ^6.4.
  • Symfony ^7.0 support will be added in a forthcoming release.

[!NOTE] ¹ To use this feature, an Auth0 tenant must have support for it enabled.

Added

• Organization Name support added for Authentication API and token handling ¹

Changed

• Bumped auth0-php dependency version range to ^8.7.
• Updated telemetry to indicate new symfony package name (previously jwt-auth-bundle.)

Note ¹ To use this feature, an Auth0 tenant must have support for it enabled. This feature is not yet available to all tenants.

Full Changelog

We are excited to announce the release of V5.0 of Auth0's Symfony SDK! This version is a complete rewrite of our Symfony bundle, and includes full support for PHP 8.1 and Symfony 6.1. It also includes numerous new features and greatly expanded functionality, including:

• Plug-and-play route controllers to instantly add Auth0 authentication to your Symfony application
• Expanded route authorization support
• Support for Symfony's new Guard APIs
• Improved performance and stability
• Full integration with v8 of the Auth0-PHP SDK and all of its features, including Management APIs, passwordless, and more

This release represents a significant upgrade to the API of our bundle, and we'd encourage you to refer to our updated README.md for usage of the new release, and guidance on upgrading your Symfony application. We hope you enjoy this new version and all the features it has to offer. Thank you for using Auth0!

Note: As of this release, we have renamed the package to auth0/symfony (previously auth0/jwt-auth-bundle) so as to better clarify the elevated functionality of the SDK into a full Auth0 integration with this release. We have marked the auth0/jwt-auth-bundle package as deprecated with Packagist to inform customers of this change. Simply update your composer.json to reference the new package name to continue receiving updates.

Full Changelog

Warning This is a beta release and is subject to breaking changes. It is not recommended for production use, but your feedback and help in testing is appreciated!

Note This package will be renamed once 5.0 is released. Users of previous releases will begin receiving a deprecation notice in Composer to upgrade their projects to 5.0 and use the new package name, at their earliest convenience.

Version 5.0 of Auth0's Symfony SDK introduces a number of exciting new features, including full support for PHP 8.0+ and Symfony 6.1+, an upgrade to Auth0's latest Auth0-PHP SDK v8, and full authentication support. The bundle has been completely rewritten to take advantage of the latest Symfony security APIs, and uses an updated configuration format that is more accessible and simpler to maintain, among other improvements.

BETA-1 adds support for Symfony's cache and session components, enabling you to leverage those built-in APIs and more easily integrate the SDK within your existing application stacks.

Added

• Integration with Symfony session management APIs #141 (evansims)
• Integration with Symfony caching component APIs #140 (evansims)

Fixed

• Minor bug fixes and performance improvements from BETA-0

Please review the updated README.md for guidance on updating your application.

Warning This is a beta release and is subject to breaking changes. It is not recommended for production use, but your feedback and help in testing is appreciated!

Note This package will be renamed once 5.0 is released. Users of previous releases will begin receiving a deprecation notice in Composer to upgrade their projects to 5.0 and use the new package name, at their earliest convenience.

Version 5.0 of Auth0's Symfony SDK introduces a number of exciting new features, including full support for PHP 8.0+ and Symfony 6.1+, an upgrade to Auth0's latest Auth0-PHP SDK v8, and full authentication support. The bundle has been completely rewritten to take advantage of the latest Symfony security APIs, and uses an updated configuration format that is more accessible and simpler to maintain, among other improvements.

BETA-0 focuses on the migration of the core classes to the new bundle structure and security APIs. BETa1 will expand support for Symfony's integrated caching mechanisms.

Please review the updated README.md for guidance on updating your application.

Full Changelog

This release introduces PHP 8.0 support and upgrades the bundle to use Auth0's PHP SDK 7.x branch. It also includes expanded JWT validation options, upgraded caching support, a simplified configuration format, and other improvements.

This release includes potential breaking changes that may require minor changes to host applications to support. Please review UPGRADING.md for guidance on updating your application.

Added

• Introduce PHP 8.0 support #108 (olix21)
• Update to latest Auth0 PHP SDK version #108 (evansims)
  • Configuration format updated. See README for example.
  • Cache support updated to support PSR-6 or PSR-16 caches. This cache is handed off to the Auth0 PHP SDK for use in JWK fetching.
  • Added opt-in JWT validation checks around nonce, azp, org_id, and aud claims, and support for max_age and leeway checks.
  • Enforces strict typing and expands type hinting.
  • Upgrades to PHPUnit 9, and updates unit tests to support syntax changes.
  • Adds unit tests for new helper classes.
  • Adds phpcs and phpstan checks.
• Adds support for Auth0 Organizations, currently in closed beta testing

Changed

• Use Symfony PSR-6 > PSR-16 cache adapter #110 (darthf1)

Full Changelog

Added

• Add support for autowiring #94 (dunglas)
• Give access to the raw JWT in the user provider #97 (dunglas)

Changed

• Remove unused argument, and unused property #95 (dunglas)

Full Changelog

Fixed

• Configuration authorized_issuer string or array compatibility #89 (antzo)

Full Changelog

Closed issues

• new release #86
• Remove SimplePreAuthenticatorInterface? #80

Added

• Symfony 5 support #87 (darthf1)
• Multiple authorized issuer #85 (antzo)

Fixed

• Fix deprecation Treebuilder::root #79 (darthf1)

Full Changelog

Added

• GuardAuthenticator implementation for Symfony 2.8 and later #75 (niels-nijens)

Closed issues

• Support Symfony4 #55
• Allow multiple audiences in config #54

Added

• Add multiple audiences capability to JWT verification #57 (joshcanhelp)
• Allow symfony/framework-bundle 4.x #56 (ricbra)

Added

• Added support for cache #51 (Nyholm)