- Does dimkinthepro/jwt-auth-bundle work with Laravel?
- No. dimkinthepro/jwt-auth-bundle is a Symfony bundle: it ships a Bundle subclass, a DependencyInjection extension with a config tree, and a Security firewall authenticator factory. It has no Laravel ServiceProvider, no guard contract, no middleware alias, and no publishes() config, so its runtime leverage in a Laravel app is zero. Treat it as a reference implementation rather than a dependency.
- How do I install this JWT bundle in a Laravel application?
- You cannot install it as a working authentication layer in Laravel. Composer may resolve the package, but it registers through Symfony's bundle and container machinery, so nothing hooks into Laravel's kernel, guard stack, or config publishing. The realistic path is to skip installation and read the source for its token service boundaries.
- Which Laravel versions does this package support?
- None. There is no Laravel version support declared or implied, because the package targets Symfony's security firewall and dependency injection. If Laravel support is a hard requirement, this package fails the framework gate outright regardless of version.
- What is the Laravel equivalent of this Symfony JWT bundle?
- Use laravel/sanctum when you need first-party SPA or API token authentication, and tymon/jwt-auth or php-open-source-saver/jwt-auth when JWT semantics are a hard requirement. Both install and configure in a day or less. This bundle's value is its reference design, not its code.
- Can I authenticate requests via the Authorization header in Laravel with this package?
- Not without writing the guard and middleware yourself. The bundle authenticates through a Symfony firewall authenticator that reads the Authorization header and resolves a user via a Symfony user provider. Laravel expects a Guard contract plus a middleware alias, and neither exists here. Any working version would be net-new authentication code, not integration.
- How hard is it to port this Symfony bundle to Laravel?
- A credible estimate is three to five engineer-weeks. That covers a ServiceProvider, a custom guard, middleware, config publishing, and mocking Symfony container and event-dispatcher semantics in tests. Compare that with under a day for Sanctum or one to two days for tymon/jwt-auth.
- Is dimkinthepro/jwt-auth-bundle actively maintained and safe for production?
- Risk is high. The repository shows zero stars, zero dependents, no issue history, and a single maintainer, which means you become the owner of every extension point you touch. The last-release date is also future-dated, so it should be pinned or blocked in Composer rather than resolved silently. Treat adoption as a permanent maintenance line item.
- How does the bundle handle token refresh, rotation and revocation?
- The overview mentions configurable refresh behaviour but evidences no refresh-token rotation, no revocation list, and no compromised-token response. If your requirement includes log out everywhere, role demotion, or forced invalidation, the buy rationale disappears. Spec that against a native solution instead.
- Which JWT library does it depend on, and does that affect security patching?
- It wraps firebase/php-jwt for signing and verification. Every JWT CVE in that dependency chain reaches your app through a package nobody is patching on your behalf. No CVE monitoring exists unless you build it, which is another permanent cost.
- How do I test this bundle's authentication in a Laravel test suite?
- You effectively cannot, because it depends on Symfony container and event-dispatcher semantics that are absent from Laravel's test harness. The practical move is to write your own feature tests against a native guard and token service. Use the bundle's claims envelope as acceptance criteria, not as test scaffolding.