Weave Code
Jose Laravel Package
gree/jose
gree/jose is a PHP JOSE library for securely signing and encrypting data with JWS and JWE. It supports JWK key management and JWT workflows, making it useful for token-based authentication and interoperable JSON security in PHP applications.
JWT, JWS and JWS implementation in PHP
Frequently asked questions about Jose
- What is gree/jose and what JOSE features does it support?
- gree/jose is a pure PHP implementation of JOSE standards covering JWT, JWS, JWE, JWK, JWK Set and JWK Thumbprint. It lets PHP applications sign and encrypt data and manage JSON Web Keys. It is an application-layer library rather than a Laravel-specific package.
- Does gree/jose work with Laravel out of the box?
- No. gree/jose has no Laravel facade, service provider, config publishing or Laravel-focused documentation. You can use it inside Laravel by binding it behind your own interfaces in a service provider. Keep its classes out of controllers, models and jobs.
- How do I install gree/jose in a Laravel project with Composer?
- Install it with Composer using composer require gree/jose after confirming PHP, OpenSSL and dependency constraints match your Laravel version. Because the package is archived, pin a commit or vendor a fork rather than relying on a floating constraint. Complete license clearance before adding it to production.
- Can I use gree/jose to verify JWTs in Laravel middleware or auth guards?
- Yes, technically, but you must write the integration yourself, for example a JwtVerifier service used by middleware, a custom guard or a webhook verifier. Ensure you enforce an algorithm allowlist, reject none, validate iss, aud, exp and nbf with clock leeway, and handle kid rotation safely. Laravel's default auth stack does not cover JOSE semantics.
- Does gree/jose support JWE encryption and JWK Set thumbprints?
- Yes. gree/jose supports JWE and JWK Set plus JWK Thumbprint, which is the strongest reason to consider it over simpler JWT libraries. JWE paths may require sodium or zlib and need careful testing for decompression and parsing edge cases. If you only need JWT verification, it is likely over-scoped.
- Is gree/jose still maintained, and is it safe for production?
- The package is archived with no apparent upstream maintenance, which is high risk for security-sensitive cryptography-adjacent code. There is no upstream security patch path, and historical stars do not establish active maintenance. Treat adoption as a fork-or-contain decision, not a normal dependency decision.
- What license does gree/jose use and can I redistribute it?
- The license is reported as NOASSERTION, so the exact terms are unclear. Legal counsel should confirm whether you can redistribute it in your product before release. Until cleared, do not ship it, and document ownership if you fork.
- What are the best alternatives to gree/jose for JWT in Laravel?
- Maintained alternatives include lcobucci/jwt, firebase/php-jwt and web-token/jwt-framework, or a managed identity provider depending on your JWE and JWK requirements. For basic JWT verification, a maintained library is usually safer. Choose based on required algorithms, key management and long-term ownership.
- How should I configure algorithm allowlists and claim validation with gree/jose?
- Put algorithm allowlists, issuer and audience values, clock skew, and key sources in config files and environment-specific secrets. Enforce an allowlist, reject none, validate claims with leeway, and fetch and cache JWKS safely with rotation handling. Test key rotation and error behavior explicitly.
- How do I test gree/jose integration and plan migration away from it?
- Create adapter interfaces such as JwtVerifier, JweDecryptor and JwkSetResolver, then add regression tests with valid and invalid token vectors. Run shadow-mode verification against your current implementation and roll out behind a feature flag with metrics. Then either migrate to a maintained library or formalize fork ownership, patching and release processes.
Weaver
How can I help you explore Laravel packages today?