Weave Code
Symfony authentication bundle with PASETO v4.local tokens, secure refresh rotation, encrypted TOTP, passwordless flows, and application-owned persistence.
Frequently asked questions about Symfony Bundle
- Can I use BetterAuth Symfony Bundle in a Laravel project instead of Laravel-specific auth packages?
- No, this bundle is explicitly designed for Symfony 6.4+ and leverages Symfony’s ecosystem (Doctrine, Security component, API Platform). While it shares core logic with Laravel’s BetterAuth, it introduces abstraction overhead for Laravel projects. Stick to Laravel-specific packages like Laravel Sanctum or Passport for Laravel apps.
- What’s the difference between Paseto and JWT in this bundle, and why does it default to Paseto?
- Paseto (Platform-Agnostic Security Tokens) is a modern alternative to JWT, designed to avoid common vulnerabilities like HMAC attacks. The bundle defaults to Paseto for security, but you can configure JWT if needed. Paseto is more secure but less widely adopted, so test thoroughly if your stack relies on JWT integrations.
- How do I set up OAuth providers beyond Google or GitHub in this bundle?
- The bundle supports OAuth out-of-the-box for Google and GitHub, but adding custom providers requires extending the `BetterAuthOAuthProvider` class or configuring additional OAuth2 clients in Symfony’s security.yaml. Use the `better-auth:configure` command to tweak OAuth settings, then register your provider in the bundle’s configuration.
- Will this bundle work with Symfony 5.4 or older versions?
- No, this bundle explicitly requires Symfony 6.4 or higher (tested up to 8.0). If you’re using an older Symfony version, you’ll need to either upgrade or explore alternatives like Symfony’s built-in Security component or third-party bundles compatible with your version.
- How do I customize the user entity or add custom fields (e.g., tenant_id) in multi-tenant setups?
- Use the `better-auth:user-fields` command to add custom fields to the `BetterAuthUser` entity. For multi-tenancy, extend the `TenantAwareTokenExtractor` to include tenant logic in token validation. The bundle auto-generates migrations for new fields, but manual adjustments may be needed for complex schemas.
- Does this bundle support session-based authentication alongside API tokens (hybrid mode)?
- Yes, the bundle supports hybrid mode out-of-the-box, combining session-based auth (for web) with API tokens (JWT/Paseto) for headless clients. Use the `better-auth:switch-mode` command to toggle between API, session, or hybrid modes. Hybrid mode is ideal for SPAs or apps with both web and mobile clients.
- How do I handle rate limiting or brute-force protection for login attempts?
- The bundle includes built-in rate limiting via Symfony’s RateLimiter component. Configure thresholds in `config/packages/better_auth.yaml` under the `rate_limiter` section. For brute-force protection, combine this with Symfony’s `LoginThrottlingListener` or integrate with tools like Fail2Ban.
- Are there any known performance bottlenecks with 2FA or token rotation?
- 2FA (TOTP) and token rotation add minimal overhead (~50–100ms per request), but heavy usage may impact performance under load. Benchmark your setup with tools like Blackfire or Symfony Profiler. For high-traffic apps, consider caching token validation or optimizing database queries for auth-related tables.
- How do I override the default Twig templates for emails or login pages?
- Publish the bundle’s templates using `php bin/console better-auth:publish-templates`, then override them in your project’s `templates/better_auth/` directory. The bundle follows Symfony’s template inheritance, so you can extend base templates (e.g., `login.html.twig`) without losing functionality.
- What’s the fallback plan if the bundle’s auto-migrations conflict with an existing Doctrine schema?
- If auto-migrations fail, manually adjust the generated migrations in `src/Migrations/` or use Doctrine’s `diff` command to merge changes. Backup your database before running migrations. For complex schemas, disable auto-migrations and manually create tables matching the bundle’s expected structure (documented in the [Database Schema Guide](docs/03-DATABASE_SCHEMA.md)).
Weaver
How can I help you explore Laravel packages today?