Weave Code
Jwt Refresh Token Bundle Laravel Package
free-work-agsi/jwt-refresh-token-bundle
A Symfony bundle for issuing and validating JWT refresh tokens, helping keep users signed in by renewing access tokens without re-authentication. Integrates with your existing JWT authentication flow.
Implements a Refresh Token system over Json Web Tokens in Symfony
Frequently asked questions about Jwt Refresh Token Bundle
- Can I install free-work-agsi/jwt-refresh-token-bundle in a Laravel application?
- No. This is a Symfony bundle, not a Laravel package. It relies on Symfony's Bundle and Kernel registration, the DI container, security authenticator factories, and the EventDispatcher, none of which Laravel boots, and it ships no service provider, facade, publishable config, or auth guard. A successful composer require only proves that the constraint graph resolves; it is not evidence the package will function inside a Laravel app.
- Is free-work-agsi/jwt-refresh-token-bundle the same as gesdinet/jwt-refresh-token-bundle?
- It appears to be a fork or mirror of the canonical gesdinet bundle published under an unfamiliar agency namespace, with zero stars and no dependents. There is no clear signal that it tracks upstream, which means it will likely lag behind security patches for rotation and reuse-detection code paths. If you have a genuine Symfony requirement, evaluate gesdinet upstream directly instead.
- How does refresh token rotation work in this bundle?
- On every successful refresh the bundle issues a new refresh token and invalidates the previous one, so a stolen token is only usable until the legitimate client next refreshes. Rotation bounds the replay window, but full reuse detection with token families is a harder problem, so verify the upstream implementation before you depend on it. Tokens are persisted via Doctrine and bound to the user, device, and expiry so they can be revoked individually.
- Which Laravel package should I use instead for JWT refresh tokens?
- Use tymon/jwt-auth if you want JWT access plus refresh semantics with a blacklist, Laravel Passport for full OAuth2 refresh grants, or Sanctum for first-party SPA and API token sessions. All three are maintained, Laravel-native, and have a large body of documented production use. None of them require the Symfony FrameworkBundle or a Doctrine entity layer.
- Does this package support Laravel 10 or 11, or only Symfony 6 and 7?
- It targets Symfony 4, 5, and 6 with lexik/jwt-authentication-bundle and Doctrine ORM/DBAL, and it has no Laravel support at all. Laravel 10 and 11 pin Symfony components only for HTTP, Console, and Process, but they never boot the FrameworkBundle, so a bundle cannot be registered or wired into a guard. This is a framework-level mismatch that configuration cannot bridge.
- How do I configure access and refresh token TTLs?
- In the bundle, both lifetimes are set through Symfony bundle configuration in YAML, typically a short access token TTL and a longer refresh token TTL. In a Laravel reimplementation you would mirror the same knobs in something like config/jwt.php with env-driven values such as JWT_TTL and JWT_REFRESH_TTL. Keep the access token short and let rotation carry the session instead of extending it.
- How do I revoke a refresh token or log a user out of all devices?
- The bundle supports revoking a single refresh token or every token belonging to a user, which is how you implement a log out everywhere action. In a Laravel-native version this is usually a revoked_at or deleted_at column plus a where clause on the user id, checked during every refresh attempt. Pair it with a scheduled cleanup so the token table does not grow unbounded.
- Does it require Doctrine, and can I use Eloquent instead?
- Yes, storage is Doctrine ORM/DBAL, so the refresh token entity assumes Doctrine metadata, mapping, and schema tooling. Eloquent does not consume Doctrine mappings, and running Doctrine alongside Eloquent in Laravel adds a second persistence layer for very little benefit. Reimplement the table as a standard Laravel migration with an Eloquent model and a scheduled prune command.
- How much work is it to reimplement this refresh token pattern in Laravel?
- The pattern is small: a refresh token table, issuance at login, rotation and revocation during refresh, and a cleanup job for expired rows. A Laravel-native implementation on top of tymon/jwt-auth, Passport, or Sanctum is realistically 200 to 400 lines including tests. That is cheaper and safer than maintaining a fork of a framework your application does not run.
- How do I test refresh token rotation and replay protection?
- Assert that the old token fails after a refresh, that expired tokens are rejected, that revoked tokens are rejected, and that a refresh token cannot be used as an access token. On Laravel, use Pest or PHPUnit with time travel for TTL assertions and RefreshDatabase for the token table. Add a test that the cleanup command deletes only expired rows, since an unbounded token table is a common operational failure.
Weaver
How can I help you explore Laravel packages today?