Weave Code
Laravel Jwt Laravel Package
codecasts/laravel-jwt
JWT authentication for Laravel: generate and validate JSON Web Tokens, protect routes with auth middleware, and add stateless token-based authentication to APIs and apps. A lightweight integration for securing Laravel endpoints with configurable JWT guards.
Dead simple JWT Auth Provider for Laravel 5.4+
Frequently asked questions about Laravel Jwt
- Is codecasts/laravel-jwt compatible with Laravel 8, 9, 10, or 11?
- The package only advertises Laravel 5.4+ and its last release was June 2017, so compatibility with modern Laravel versions is not established. Composer dependency resolution and JWT library constraints may fail on newer Laravel releases. Treat modern-version support as a compatibility spike and test the exact runtime in CI before adopting it.
- How do I install codecasts/laravel-jwt?
- Install it with Composer using composer require codecasts/laravel-jwt, then publish any package configuration and set your JWT secret and guard options. Wire the package's guard and middleware into config/auth.php and your route middleware as needed. Because the package is old, pin versions and verify the install against your target Laravel and PHP versions in a non-production spike.
- How do I protect Laravel routes with this package's JWT middleware?
- Issue a JWT on login and send it as a bearer token, then apply the package's auth middleware or the standard auth:api guard to protected routes. The package is designed to integrate with Laravel's native guard and middleware model, so route protection follows normal Laravel auth patterns. Confirm the exact middleware alias and guard name from the package configuration before wiring production routes.
- Does codecasts/laravel-jwt support refreshing and invalidating JWTs?
- The package exposes refresh and invalidate helpers, which can support token rotation and logout flows. You must verify whether invalidation is durable and cluster-safe or only works in-process or is session-dependent. For production, define token lifetime, refresh behavior, and revocation storage before relying on these helpers.
- Is codecasts/laravel-jwt still maintained?
- It appears effectively unmaintained: the last release was June 2017 and there is little evidence of ongoing maintenance. That creates dependency, compatibility, and security review burden. Check for maintained forks or newer JWT packages before committing to it for long-lived applications.
- What are the best alternatives to codecasts/laravel-jwt for Laravel JWT auth?
- For most modern Laravel apps, Laravel Sanctum or Passport are the default first-party options, depending on whether you need simple API tokens or full OAuth2. If you specifically need JWTs, evaluate a maintained JWT package with recent Laravel and PHP support. Use codecasts/laravel-jwt only as a contained legacy adapter, not as a greenfield dependency.
- Can I use codecasts/laravel-jwt for stateless API authentication with Laravel guards?
- Yes, architecturally it fits Laravel's guard and middleware model and is intended for stateless token-based authentication. It can sit behind standard auth:api route protection and issue or validate JWTs without introducing a separate identity service. The main constraint is version compatibility and lifecycle risk, not the basic guard integration pattern.
- What security issues should I check before using this JWT package in production?
- Review the signing algorithm and confirm insecure algorithms are rejected, along with secret management, token lifetime, refresh behavior, revocation, and clock-skew handling. Confirm whether invalidation is durable and cluster-safe across multiple app instances. Also check the dependency vulnerability posture and test coverage, since the package has not had a release since 2017.
- Does codecasts/laravel-jwt handle token revocation across multiple app instances?
- The package provides invalidate helpers, but the assessment warns that you must confirm whether invalidation is durable and cluster-safe or merely in-process or session-dependent. Multi-instance deployments require shared revocation storage such as a database or cache, plus a clear strategy for refresh and secret rotation. Validate this behavior in a non-production spike before relying on it.
- Which Laravel and PHP versions does codecasts/laravel-jwt support, and does it have tests?
- The package advertises Laravel 5.4+ and had its last release in June 2017, so supported PHP versions should be assumed to be old until proven otherwise. The assessment flags stale dependency constraints and limited test coverage as key risks. Build a compatibility matrix and require a passing install and auth flow in CI against your exact target runtime.
Weaver
How can I help you explore Laravel packages today?