Symfony Bundle Laravel Package

Removed

• Breaking: OAuth and OpenID Connect client services, ports, outcomes, authorization transaction objects, feature flags, feature ports, and issuer configuration are removed from BetterAuth Symfony. Applications own those integrations independently when needed.

Added

• Bilingual public documentation and a local-only Symfony/Doctrine demo.

Changed

• Version 1.0 is a Symfony-only PASETO access-token bundle. OAuth and OIDC are relying-party/client orchestration services with application-owned atomic state, PKCE and (for OIDC) nonce transactions. OIDC validation is delegated to a typed application port; BetterAuth PASETO values are never ID tokens.
• TOTP seeds are domain-separated AES-256-GCM ciphertext before application persistence. One-time-token stores must atomically consume an unexpired, unconsumed purpose-and-hash record.
• OAuth approvals happen before state persistence and require S256 PKCE. The release workflow reuses the complete Symfony quality matrix before release creation.
• CI now verifies the current PHP 8.5 and Symfony 8.1 pair in addition to the PHP 8.4 compatibility rows for Symfony 6.4, 7.4, and 8.0.

Historical releases

The entries below document the retired pre-1.0 standalone package only. They may mention its former multimodal dependency, Doctrine adapters, controllers, or migrations; those are not current 1.0 behavior or requirements.

Fixed

• Migration Version20260722120000 (SEC-30 token indexes) no longer touches the $schema argument at all. v0.1.1 stopped mutating it but still read it ($schema->hasTable()); that read alone realizes Doctrine's LazySchemaDiffProvider and triggers the same full-schema Comparator::compareSchemas(), which still aborts with a spurious TableDoesNotExist on an unrelated host table when the host schema has drift. The migration now inspects the live connection's schema manager (scoped to the token tables) for idempotency and emits raw CREATE INDEX — the lazy diff is never realized.

Fixed

• Migration Version20260722120000 (SEC-30 token indexes) no longer mutates the Schema object. Calling $table->addIndex() made Doctrine compute a full-schema diff, which introspects every table of the host application and aborts on any unrelated schema drift (TableDoesNotExist on a host table). It now emits raw CREATE INDEX via addSql() while still reading $schema for idempotency — same fix already applied to Version20260621120000. (Superseded by 0.1.2: reading $schema is itself enough to trigger the abort.)

Changed

• Requires betterauth/multimodal-php ^0.1 (was ~0.0.3), which carries the matching core security hardening.

Security

Hardening pass from the 2026-07-22 security audit. All changes are test-backed.

• CSRF on cookie auth — the CookieTokenExtractor is no longer in the default token-extractor chain (cookie auth is now opt-in), and CsrfProtectionSubscriber enforces a double-submit X-CSRF-TOKEN header on every state-changing request that carries the auth cookie (any path/mode); Bearer and cookie-less requests are exempt. Breaking for apps relying on implicit cookie auth — re-add the extractor and keep the CSRF subscriber enabled.
• Tokens hashed at rest — Doctrine magic-link, password-reset and email-verification repositories hash tokens with SHA-256 (matching refresh tokens).
• Login rate limiting — an account-wide limit (per email, IP-independent) is added alongside the per-(IP,email) limit to bound distributed brute-force / credential stuffing.
• Open-redirect / token exfiltration — the callback-URL validator now also matches the scheme (no https→http downgrade).
• Installer — FlexInstaller uses Process (argument array) instead of exec(); the signing secret is written to .env.local (chmod 0600), not the committed .env.
• Misc — DB indexes on token tables (user_id/expires_at), guest-session creation rate-limited per IP, TotpProvider wired with a rate limiter, PII masked in password-reset logs, multi_tenant.enabled defaults to false (aligned with the config template).

Re-release of 0.0.22. The 0.0.22 release automation failed on a locked tag, so its git tag (while retained and installable) has no published GitHub release; this patch re-issues the same dependency-constraint fix under a clean tag. No code changes since 0.0.22.

Fixed

• Dependency constraint for betterauth/multimodal-php now allows the tagged 0.0.x line (~0.0.3 || dev-main). The previous ^0.1 matched no published 0.0.x release, so a tagged install could only resolve the Core package from the dev-main branch.

Added

• Opaque session id. Sessions now carry an opaque id (decoupled from the secret token) usable as a safe revocation/listing handle. DoctrineSessionRepository implements findById() / deleteById() and persists the id verbatim (never hashed). SessionController::list() exposes id and resolves the current flag from the bearer token via AuthManager::validateSession() (the previous token comparison was always false once tokens became hashed at rest).
• login/login2fa now verify credentials via AuthManager::verifyCredentials() and create the session/tokens via completeSignIn(), removing the redundant second password verification while keeping the 2FA gate before any session/token is created.

Database

• Migration Version20260621120000: adds a nullable, unique id column to sessions and backfills an opaque id for every pre-existing row.

Fixed

• Security: stopped logging the SMTP DSN (which contains the SMTP password) and the email verification link/token in SymfonyMailerEmailSender.
• DoctrineUserRepository::create()/update() now read the canonical password_hash key. Sign-up on the Doctrine path persisted the password as NULL, so every subsequent login failed with InvalidCredentialsException — now fixed.
• Password-less guest conversion no longer fails on a random-password sign-in; it issues tokens for the converted user (or returns 400 in session-only mode).
• SessionController::list() guards validateSession() by session mode, so listing no longer errors in pure API mode.

Security

• Brute-force protection on login. CredentialsController::login() and login2fa() are now rate-limited (5 attempts / 15 min per IP+email) before the manual password/TOTP checks. Previously the rate limiter was only reached after a successful password, leaving password and TOTP brute-force unbounded.
• Open-redirect / token exfiltration fixed. Magic-link and email-verification endpoints validate the user-supplied callbackUrl against the trusted frontend origin before embedding it in the emailed link (returns 400 on a foreign host).
• Session tokens hashed at rest. DoctrineSessionRepository stores sha256(token) and looks up by hash. A DB read no longer yields usable session tokens.
• TOTP secret encryption at rest. DoctrineTotpRepository encrypts the TOTP seed with AES-256-GCM, keyed from %better_auth.secret%.
• Refresh token replaced_by hashed for consistency (no raw replacement token stored).
• Cookie security flags declared. cookie_secure / cookie_http_only / cookie_same_site are now part of the configuration tree (the recipe shipped them but they were undeclared, which could break boot or silently drop them). Secure defaults: true / true / lax.

Changed

• Session-mode auth responses no longer duplicate the session token as refresh_token (it is now null — session mode has no separate rotatable credential).
• Emails are masked in failure logs (ke***[@domain](https://github.com/domain)) to avoid leaking PII into centralized logs.
• QueryParameterTokenExtractor documentation strengthened; it remains off by default (not part of the default ChainTokenExtractor).

Migration notes

• Existing data migrates automatically and transparently after deploy — no manual step, no forced logout. When the patched code goes live (e.g. via composer update):
  • legacy plaintext session rows are rehashed in place on first access;
  • legacy plaintext TOTP secrets are re-encrypted in place on first access (the enc:v1: marker distinguishes encrypted from legacy values).
• A literal composer install hook is intentionally not used: dependency composer scripts do not run in the consumer project, and auto-running DB migrations at build time would break CI. The self-migrating repositories achieve the same result safely.
• Keep BETTER_AUTH_SECRET stable — rotating it makes already-encrypted TOTP secrets unreadable.

• See git history.