- How do I integrate this OAuth2 server with Laravel’s existing authentication (e.g., Sanctum, Breeze, or Jetstream)?
- This package wraps the oauth2-server-php library, so you’ll need to manually bridge Laravel’s user providers (e.g., Sanctum’s `User` model) with the OAuth2 server’s user authentication logic. Use Laravel’s service container to bind your user provider to the OAuth2 server’s `UserAuthenticationProviderInterface`. For example, if using Sanctum, extend the OAuth2 user entity to match Sanctum’s user structure and handle token generation via Sanctum’s built-in methods.
- Can I use this package with Laravel 10 or PHP 8.2? What’s the compatibility like?
- The package is built on oauth2-server-php, which supports PHP 8.1+. For Laravel 10, ensure your PHP version is compatible (8.1+) and test thoroughly, as Laravel-specific abstractions are minimal. If issues arise, check the underlying oauth2-server-php repository for updates or consider forking to add Laravel 10 support. No official Laravel 10 badge exists, so manual verification is required.
- How do I configure token storage—JWT vs. database-backed tokens—in Laravel?
- The package supports both stateless (JWT) and stateful (database) token storage. For JWTs, use Laravel’s `firebase/php-jwt` package to generate and validate tokens. For database storage, create a migration for a `oauth_access_tokens` table and implement a custom `TokenStorage` class. Leverage Laravel’s caching (Redis) for performance if using stateful tokens, but encrypt sensitive data with `defuse/php-encryption` for security.
- Does this package support all OAuth2 grant types (e.g., Authorization Code, Client Credentials, PKCE)?
- The package supports standard grant types like Authorization Code and Client Credentials out of the box, but custom grants (e.g., PKCE, Refresh Token) require manual implementation. For PKCE, validate the `code_verifier` and `code_challenge` in Laravel middleware or a custom grant handler. Refer to the oauth2-server-php documentation for grant-specific logic, as Laravel abstractions are limited.
- How do I revoke tokens or implement token introspection in Laravel?
- Token revocation isn’t built-in, so you’ll need to create a custom endpoint (e.g., `/oauth/revoke`) that updates your token storage (database/cache). For introspection, build an endpoint that queries your storage layer. Use Laravel’s middleware to protect these endpoints and log revocation events. For distributed systems, invalidate tokens via Redis or a pub/sub system like Laravel Horizon.
- Is there built-in rate limiting or protection against OAuth2 attacks (e.g., brute-force, replay attacks)?
- No, this package lacks built-in rate limiting or OAuth2-specific security features. Mitigate risks by integrating Laravel packages like `spatie/rate-limiter` for endpoint protection and using middleware to validate requests (e.g., CSRF, CORS). For replay attacks, implement token expiration checks and one-time-use flags in your storage layer. Always follow OAuth2 security best practices, such as short-lived tokens and secure client credential storage.
- Can I extend this to support OpenID Connect (OIDC) or custom claims in Laravel?
- This package focuses on OAuth2 core functionality, so OpenID Connect (OIDC) support requires additional libraries like `league/oauth2-server` or `php-openid/light`. For custom claims, extend the OAuth2 server’s `AccessToken` entity or use Laravel’s service container to inject custom logic. Document your extensions thoroughly, as they won’t be maintained by the package’s core team.
- How do I test OAuth2 flows in Laravel (e.g., unit/integration tests for token issuance)?
- Use Laravel’s HTTP tests to simulate OAuth2 flows. Mock the OAuth2 server’s dependencies (e.g., user provider, token storage) with PHPUnit’s `createMock()`. Test endpoints like `/oauth/authorize` and `/oauth/token` by sending requests with client credentials and validating responses. For token validation, test middleware or resource server logic with forged JWTs or database entries. Example: `Http::fake(['oauth2-server-url'])` to intercept requests.
- What’s the performance impact of using this package in production? How can I optimize it?
- Performance depends on token storage (JWTs are fastest) and grant type complexity. For high traffic, offload token generation/validation to queues (Laravel’s `dispatchSync`) or use Redis for distributed token storage. Cache frequently accessed user/client data in Laravel’s cache layer. Benchmark with tools like Blackfire to identify bottlenecks, especially in stateful token workflows.
- Are there alternatives to this package for Laravel OAuth2, and when should I choose them?
- For Laravel, consider `laravel/passport` (built-in OAuth2 server with Passport’s abstractions) or `league/oauth2-server` (more feature-rich but less Laravel-native). Use this package if you need lightweight PHP-native integration without Passport’s overhead or if you’re extending an existing oauth2-server-php setup. Choose Passport for out-of-the-box Laravel features (e.g., migrations, facades) or league/oauth2-server for advanced OAuth2/OIDC support.