- Is gfreeau/get-jwt-bundle a Laravel package?
- No. gfreeau/get-jwt-bundle is a Symfony bundle built on the Symfony Security component's firewall listener and DI extension model, and it has no direct equivalent in Laravel's middleware and service-provider architecture. Treat it as a Symfony-only package when evaluating Composer dependencies for a Laravel application. If your stack is Laravel, its architectural fit is effectively zero.
- Can I use gfreeau/get-jwt-bundle in a Laravel application?
- You can run composer require, but you cannot actually consume it in Laravel without rewriting the integration. The bundle hooks into Symfony's security firewall and authentication provider contracts, which Laravel does not provide. The practical path is to extract the JWT issue and verify logic and reimplement it as Laravel middleware, usually with firebase/php-jwt. Porting is almost always cheaper and safer than forcing adoption.
- Which Symfony and PHP versions does gfreeau/get-jwt-bundle support?
- The package does not advertise a reliable modern support matrix in the provided assessment, and its quality score and age suggest Symfony 2.x/3.x-era APIs such as GetResponseEvent-style listeners. Expect pinned Composer constraints against end-of-life Symfony and PHP branches. Before any use, verify the exact Symfony and PHP constraints, ext-openssl availability, and PSR-4 autoloading against your runtime. Assume a fork and patch will be required.
- How do I install and configure gfreeau/get-jwt-bundle?
- Installation is a composer require plus firewall YAML configuration that wires the bundle's listener to your existing Symfony user provider. You configure the token endpoint and the firewall entry point, and clients then request a JWT and send it back. There is no Laravel installation story; in Laravel you would be installing an unusable Symfony dependency. Validate that your Symfony version still supports the listener signature before committing.
- What are the best Laravel alternatives to this JWT bundle?
- For Laravel, use tymon/jwt-auth for a community JWT-native option, Laravel Sanctum for first-party opaque tokens, Laravel Passport for OAuth2, or firebase/php-jwt plus a thin custom middleware. The last option has the smallest dependency surface and the longest likely lifespan. Choose based on whether you need stateless JWTs, SPA cookie auth, or full OAuth2.
- Does this bundle issue tokens, validate them, or both?
- Based on the assessment, the bundle primarily issues and authenticates JWTs through a Symfony security listener, but the exact validation behavior should be confirmed in source. Revocation is not addressed, and you should verify whether iss, aud, exp, and nbf claims are validated with clock-skew tolerance and algorithm pinning. Do not assume refresh, deny-list, or logout semantics exist. If those controls are missing, they are your responsibility to add.
- Are GET query string JWTs safe for authentication?
- No. GET-borne tokens land in access logs, proxy and CDN logs, Referer headers, browser history, and analytics, which is a well-known security anti-pattern. This alone can fail a security review. If you keep JWT auth, send tokens in the Authorization header and ensure TLS everywhere. The bundle's GET-oriented transport is a strong reason not to adopt it as-is.
- Which JWT library and algorithms does gfreeau/get-jwt-bundle use?
- The assessment flags a likely abandoned JWT dependency such as namshi/jose and expects HS256-only support rather than RS256 or ES256. That combination is a maintenance and security liability, especially with no upstream pressure to patch CVEs. Read composer.lock and the source to confirm the library, algorithm support, and key handling. If you proceed, fork and swap in a maintained JWT library.
- Is gfreeau/get-jwt-bundle maintained and production-ready?
- No. The package has roughly 85 stars, zero dependents, a quality score around 2.82, and a bus factor of one, with no vendor SLA or security disclosure policy noted. That means no production reference base and no community to absorb framework upgrades or CVE patches. Treat it as unproven and self-owned if you use it at all. It is tolerable only as a forked, internally maintained component, and it should stay off any critical release path.
- How do I migrate JWT auth from this Symfony bundle to Laravel?
- Reimplement the bundle's behavioral contract natively in Laravel: an AuthController@issue endpoint plus a VerifyJwt middleware backed by firebase/php-jwt, preserving the same claim schema so clients are unaffected. Pin the algorithm, validate iss, aud, exp, and nbf with clock-skew tolerance, and define revocation explicitly. Run it behind a feature flag and dual-run against your current auth path before cutover. If you already operate Symfony, an alternative is to keep the bundle as an internal token-issuing service and verify tokens in Laravel against a shared public key.