Weave Code
Wsse Authentication Bundle Laravel Package
escapestudios/wsse-authentication-bundle
EscapeWSSEAuthenticationBundle provides simple, out-of-the-box WSSE authentication for Symfony applications. Secure stateless API firewalls via security.yml, with configurable token lifetime, custom date formats, and a console command to delete expired nonces.
Symfony bundle to implement WSSE authentication
Frequently asked questions about Wsse Authentication Bundle
- Is escapestudios/wsse-authentication-bundle a Laravel package?
- No. It is a Symfony bundle targeting Symfony 2.x and 3.x, registered through AppKernel::registerBundles() and configured in app/config/security.yml. It ships no Laravel service provider, middleware, or framework hook, so Composer will install it but nothing in Laravel will use it. For a Laravel app, treat the repository as a protocol reference with working sample code rather than a dependency.
- What exactly does this bundle implement for WSSE authentication?
- It implements the WSSE UsernameToken profile with PasswordDigest, where the digest is base64(sha1(nonce + created + password, true)). On top of the hash it adds a Symfony security firewall factory, a token class, a nonce replay cache, and a console command to purge expired nonces. Scope is UsernameToken only: no XML Digital Signature, no X.509, no body signing, and no encryption. If the counterparty spec requires signing the payload, this package is out of scope entirely.
- How do I install and configure it in a Symfony application?
- Require escapestudios/wsse-authentication-bundle with the ^2.2 constraint, register EscapeWSSEAuthenticationBundle in AppKernel::registerBundles(), then add a firewall in app/config/security.yml with stateless: true and a wsse block containing realm and profile: UsernameToken. That is roughly five lines of config and the firewall is protected out of the box. Clients then send an X-WSSE header generated with the matching MessageDigestPasswordEncoder logic.
- Does it work with Symfony 4, Symfony 5, Symfony 6, or Laravel?
- No. The documented integration points are all pre-Symfony-4: AppKernel::registerBundles(), app/config/security.yml, and app/console. Symfony 4+ moved to Flex bundle-less registration and different config paths, so expect friction or outright incompatibility without a fork. There is no Laravel support at all, with no service provider and no middleware.
- How do I generate the X-WSSE header a client must send?
- Compute PasswordDigest as base64 of the raw SHA1 of nonce + created + password, then send an X-WSSE header containing Username, PasswordDigest, Nonce, and Created. The nonce is base64-encoded bytes and Created must match the configured date format, ISO8601 by default. In Symfony the reference implementation uses MessageDigestPasswordEncoder. Test with fixed nonce and created values so digest and byte-handling bugs surface immediately.
- How do token lifetime, clock skew, and date format work?
- lifetime defaults to 300 seconds and controls the freshness window applied to the created timestamp, while -1 means infinite lifetime, which the README itself warns to use with extreme care. date_format is a regex for the accepted timestamp format, defaulting to ISO8601. Because freshness is timestamp-based, clock skew between client and server directly causes auth failures, so keep hosts on NTP.
- Where are nonces stored, and how do I delete expired ones?
- The default nonce cache is PhpFileCache inside %kernel.cache_dir%, which is the biggest operational trap: it is per-node, so a load-balanced cluster will not share replay state. Purge expired nonces with php app/console escape:wsseauthentication:nonces:delete firewall_name, which takes the firewall name as a required argument. For multi-node deployments, back the nonce cache with a shared store such as Redis.
- Is this package maintained and safe to use in production?
- The signals are loud: 135 stars, zero dependents, a Travis CI badge, app/console commands, a ^2.2 constraint, and a maturity grade of readme only. Zero dependents means zero ecosystem pressure to fix anything, so you become the maintainer the day you adopt it. Production safety comes from scoping rather than the package itself: TLS only, partner endpoints only, short token lifetimes, and a shared nonce store.
- Should I change the digest algorithm to bcrypt as the README suggests?
- No. The README recommendation to use a stronger encoder like bcrypt is a footgun for interoperability: WSSE UsernameToken PasswordDigest is defined as SHA1 over nonce + created + password, so any counterparty implementing the standard will send SHA1 and a changed encoder will simply reject valid partner requests. Address the security posture with transport and scope instead: TLS-only, restricted partner endpoints, short lifetimes, and a replay-protected nonce store.
- What is the best way to get WSSE authentication in a Laravel app?
- Port the protocol into a Laravel middleware or guard rather than installing this bundle. The work is bounded: one hash construction (base64 of raw sha1 of nonce + created + password), a freshness window, a nonce replay cache in a shared store like Redis, and credential lookup. Cover it with feature tests using fixed nonce and created values. Before writing any code, ask whether the partner accepts mTLS, OAuth2 client credentials, or signed JWTs, because if so the whole evaluation is moot.
Weaver
How can I help you explore Laravel packages today?