Weave Code
Auth0 Bundle Laravel Package
happyr/auth0-bundle
A Symfony bundle that integrates Auth0 authentication into your app, letting you secure routes and authenticate users through Auth0 with minimal configuration. It provides security integration and user handling for Symfony projects.
Symfony integration for Auth0
Frequently asked questions about Auth0 Bundle
- Is happyr/auth0-bundle compatible with Laravel?
- No. happyr/auth0-bundle is a Symfony bundle, not a Laravel package, and it integrates through Symfony-specific primitives such as a Bundle subclass, config/bundles.php registration, DI compiler passes, services.yaml wiring, and Symfony's security firewall and authenticator system. Laravel has no equivalent bundle registration path; it uses service providers, config files, middleware, and guards. Making the bundle work in Laravel would require re-implementing its security listener as a guard and shadowing its configuration schema, which is effectively a rewrite.
- What does happyr/auth0-bundle actually do?
- It integrates Auth0 authentication into Symfony applications so you can protect routes and authenticate users through Auth0's hosted login. It connects Auth0 identities to Symfony's security system with configurable firewalls, user providers, and token handling. It also maps Auth0 profiles to Symfony users, supports JWT access token validation, and is configured through simple YAML for firewalls and routes.
- How do I install happyr/auth0-bundle?
- You install it with Composer and then register it in config/bundles.php, which is the standard Symfony bundle installation flow. After registration you configure the Auth0 domain, client ID, and audience in YAML along with your firewall and route settings. There is no Laravel-style config publishing or service provider step because the package targets Symfony only.
- What is the Laravel alternative to happyr/auth0-bundle?
- For Laravel, use the official auth0/laravel-auth0 SDK, which is maintained and ships the guard, middleware, and session handling you need out of the box. If you want tighter control, wrap the framework-agnostic auth0/auth0-php library in a first-party Laravel service provider. Both options give you a supported upgrade path and a vendor to escalate security issues to, which the Symfony bundle does not.
- Is happyr/auth0-bundle still maintained?
- The last release was 2021-09-25, making it roughly four years stale, and it has around 14 stars with zero dependents. No downstream consumers means there is little incidental testing against modern framework versions and no community pressure to patch issues. Because it is an authentication integration, the lack of maintenance is a real risk rather than a cosmetic concern.
- Can I use happyr/auth0-bundle in Laravel 11 or Laravel 12?
- Practically no. Its PHP and Symfony version constraints are likely to conflict with Laravel 10, 11, and 12 projects, which typically run PHP 8.1 and newer. Forcing compatibility would mean pinning old framework components across your application, which is unacceptable for an auth dependency. Run composer why-not happyr/auth0-bundle and composer audit against your target skeleton if you want to confirm the conflicts before deciding.
- How do I configure the Auth0 domain, client ID, and audience?
- Configuration is done in YAML under the bundle's configuration key, where you set the Auth0 domain, client ID, and audience alongside firewall and route settings. Symfony then wires these values into its security system through the bundle's dependency injection extension. This YAML-driven approach does not map onto Laravel's config/auth0.php and configuration caching model without an adapter.
- Does happyr/auth0-bundle validate JWT access tokens?
- Yes, it supports JWT access token validation and session-based authentication through Auth0. However, it pins an older era of the Auth0 PHP SDK, so newer capabilities such as Organizations, adaptive MFA, and updated JWKS handling are not supported. If you need those features, use the current official SDK instead of this bundle.
- What are the security risks of using a stale Auth0 integration?
- Authentication is a security-critical boundary, and an unmaintained integration means transitive CVEs in the Auth0 PHP SDK version it pinned, no support for newer Auth0 capabilities, and no security advisories you can track against it. With no dependents there is no community testing against modern framework versions, so problems surface only in production. For Laravel, the safer choice is a maintained vendor-supported SDK with a clear escalation path.
- When should I use happyr/auth0-bundle instead of a Laravel Auth0 SDK?
- Reserve it for a legacy Symfony application where it genuinely targets the existing security firewall setup, and even there it is a plausible but stale choice. For any Laravel application, it is the wrong tool: use auth0/laravel-auth0 or wrap auth0/auth0-php in a service provider. Before committing, confirm which Auth0 capabilities are in scope and who owns the identity boundary, because that determines whether a framework-native SDK is sufficient.
Weaver
How can I help you explore Laravel packages today?