Weave Code
Jwt Refresh Token Bundle Laravel Package
gesdinet/jwt-refresh-token-bundle
Symfony bundle to manage JWT refresh tokens for LexikJWTAuthenticationBundle. Stores and rotates refresh tokens via Doctrine ORM or MongoDB ODM (or custom object manager), with configurable TTL, security, and endpoints. Requires PHP 8.2+ and Symfony 6.4+.
Implements a Refresh Token system over Json Web Tokens in Symfony
Frequently asked questions about Jwt Refresh Token Bundle
- Can I use this bundle with Laravel instead of Symfony?
- No, this bundle is designed exclusively for Symfony and LexikJWTAuthenticationBundle. Laravel developers should explore alternatives like *spatie/laravel-jwt-refresh-token* or *tymon/jwt-auth*, which are Laravel-native packages.
- What Laravel versions does this bundle support?
- This bundle does not support Laravel—it’s built for Symfony 6.4+, 7.2+, or 8.0+. If you need JWT refresh tokens in Laravel, check compatibility with Laravel 10+ and PHP 8.2+ for similar functionality.
- How do I configure single-use refresh tokens to prevent replay attacks?
- Enable single-use tokens by setting `single_use: true` in your `gesdinet_jwt_refresh_token.yaml` config. This ensures each refresh token can only be used once, mitigating replay attacks. Pair this with HTTPS to prevent interception.
- Will this bundle work with my existing Doctrine database schema?
- Yes, but you’ll need to create a `refresh_tokens` table (ORM) or collection (ODM). The bundle provides migrations or manual schema setup. Ensure the `token` field is indexed for fast lookups during refresh operations.
- How do I secure refresh tokens from being logged or exposed in API responses?
- Configure `remove_token_from_body: true` in your bundle settings to strip refresh tokens from JSON responses. For additional security, store tokens in HTTP-only cookies instead of returning them in the body.
- Can I use Redis or another cache layer instead of Doctrine for token storage?
- The bundle supports custom persistence layers. You can implement a Redis-backed solution by creating a custom `ObjectManager` or using a library like *predis/predis* to cache `RefreshToken` entities, reducing database load.
- What’s the impact of enabling `ttl_update: true` on performance?
- Enabling `ttl_update: true` extends token validity on each refresh but adds write operations to your database. For high-traffic APIs, this may increase latency. Test under load or consider caching token metadata in Redis.
- How do I revoke refresh tokens when a user logs out?
- Manually delete the associated `RefreshToken` entity from your database or cache. For bulk revocation (e.g., password changes), implement a custom event listener to invalidate all tokens tied to a user.
- Are there alternatives for Laravel if this bundle isn’t compatible?
- For Laravel, consider *spatie/laravel-jwt-refresh-token* (Laravel 8+), *tymon/jwt-auth* (Laravel 5.5+), or *firephp/jwt* for custom implementations. These packages offer similar refresh token rotation and TTL management.
- How do I test token refresh functionality in my Symfony application?
- Use Symfony’s `HttpClient` to simulate refresh requests to `/api/token/refresh`. Mock the `RefreshToken` repository to return test tokens and verify responses. Test edge cases like expired tokens, single-use flags, and concurrent refreshes.
Weaver
How can I help you explore Laravel packages today?