Symfony Jwt Authenticator Bundle Laravel Package

Getting Started

This is a Symfony bundle, not a Laravel package. There is no service provider, no config/jwt.php to publish, and php artisan package:discover does nothing for it. The practical starting point for a Laravel developer is a decision, not an install:

• Laravel-only stack? Don't install it. Reach for tymon/jwt-auth, Sanctum, Passport, or firebase/php-jwt directly. This bundle buys you nothing inside Laravel's guard/middleware model.
• Polyglot stack (a Symfony service in the auth path — legacy app, standalone API, auth microservice) that shares tokens with your Laravel app? Then it's a candidate for the Symfony side only.

Minimal steps if you do proceed:

1. composer require halloverden/symfony-jwt-authenticator-bundle — but with 0 stars, 0 dependents, and a 0.1 score, treat this as unreviewed code. Read the source first, or pin an exact commit.
2. Register it in config/bundles.php. This is manual; Laravel devs will look in vain for auto-registration.
3. Read src/ in this order: the DI extension class, the class implementing Symfony's AuthenticatorInterface, then any DependencyInjection/Configuration.php for the actual config keys.
4. Wire it into a firewall in config/packages/security.yaml, sourcing key material from env vars.
5. First use case: a stateless api firewall (stateless: true) where the login route is security: false and everything else is guarded by this authenticator.

Look at composer.json before anything else — the supported Symfony version range determines which authenticator API applies, and that changed in breaking ways across 5.x → 6.x → 7.x.

Implementation Patterns

• Firewall-per-surface. Keep api (stateless, JWT) separate from web (session). Do not mix both authenticators on one firewall; Symfony's firewall semantics make the failure modes confusing.
• Header extraction. Expect Authorization: Bearer <token>. Confirm whether the bundle ships a token extractor or whether you need to supply one — this is the first thing to verify in source.
• User provider bridging. A well-built authenticator returns a passport/badge that delegates to your configured UserProvider. Keep DB lookups there, not inside the authenticator, so you retain a clean seam for caching and multi-tenant providers.
• Cross-framework shared keys — the highest-value pattern here. Let Laravel issue tokens (firebase/php-jwt or Passport) and Symfony validate them. Agree on alg, iss, aud, and claim names before writing code. Prefer RS256: Laravel signs with the private key, Symfony only ever holds the public key.
• Mirror the claims in Laravel. If Laravel also consumes the same tokens, back it with an Auth::viaRequest guard or a small middleware so both runtimes interpret claims identically. Keep TTL and refresh logic in exactly one service.
• Testing. Mint tokens in tests from a fixture keypair. Assert 401 and 403 separately — unauthenticated and authenticated-but-unauthorized are produced at different layers in Symfony, and conflating them hides real bugs.

Laravel-side equivalents, by role: issuer → tymon/jwt-auth or Passport; first-party SPA → Sanctum; verifier of externally issued JWTs → a small custom guard around firebase/php-jwt.

Gotchas and Tips

• Reputation is the headline gotcha. 0 stars and 0 dependents means no third-party review, no CVE history, and no Stack Overflow answers when you're stuck. Pin a commit and be ready to fork.
• Version coupling. The Symfony authenticator interface changed meaningfully between majors. Any snippet you find online may target a different contract than the one this bundle implements.
• Registration is manual. composer require alone accomplishes nothing; without the config/bundles.php entry you'll debug a "missing service" for an hour.
• Key handling. Never commit secrets; use %env(...)%. With HS256, both frameworks must share the byte-identical secret — encoding and trailing newlines bite here constantly.
• Clock skew. Configure leeway on the consumer, or tokens minted on the Laravel host will intermittently look "not yet valid" on the Symfony host. Check whether nbf is validated strictly.
• Algorithm pinning. Verify in source that the validator restricts accepted algorithms. alg: none acceptance is a known JWT bug class, and with an unvetted package you must confirm this yourself rather than assume.
• Debugging order. When the authenticator never fires, run bin/console debug:firewall <name> and debug:container --tag=security.authenticator first. Nine times in ten it's a firewall wiring problem, not a token problem.
• Cheapest extension points if you fork: a custom UserProvider, a token extractor, and listeners on authentication success/failure. Keep those out of the validation logic.
• Blunt recommendation: for a Laravel-only team this is at best a reading reference. For a team with a Symfony service in the auth path, weigh it against ~150 lines of your own authenticator around firebase/php-jwt — for a zero-star dependency, that's frequently the lower-risk choice.