Weave Code
Google Site Authenticator Bundle Laravel Package
happyr/google-site-authenticator-bundle
Symfony bundle for adding Google Authenticator two-factor authentication to login flows. It generates and verifies time-based six-digit codes, integrates with Symfony security, and gives older Symfony apps a simple way to add TOTP-based 2FA without external services.
HappyR Google Site Authenticator Bundle adds TOTP two-factor authentication to Symfony applications using Google Authenticator-compatible apps. It handles per-user secret generation, code validation, and integration with your existing security flow.
- Generates and stores per-user TOTP secrets
- Validates 6-digit authenticator codes
- QR-code provisioning for authenticator apps
- Pluggable Symfony security integration
- Configurable issuer and validation window
Frequently asked questions about Google Site Authenticator Bundle
- Can I use happyr/google-site-authenticator-bundle in a Laravel application?
- Not directly. It is a Symfony bundle built around a DependencyInjection Extension class and a YAML config tree, concepts Laravel's container and bootstrap lifecycle never boot. There is no service provider, no facade, and no publishable Laravel config, so Composer will not auto-register anything useful to your app. The pragmatic path is to read its roughly 50 to 100 lines of glue and rewrite the behaviour as a small first-party Laravel package.
- Does it support Laravel 10, 11 or 12 and PHP 8.2?
- There is no evidence of support for any of these. The last release was 2020-11-11, and its pinned Symfony constraints will likely conflict with a modern Laravel app's dependency tree. Support for PHP 8.1+, Symfony 6 or 7, and current google/apiclient releases is unverified. Assume it will not install cleanly without major constraint surgery.
- Is happyr/google-site-authenticator-bundle still maintained?
- Effectively no. It is a single-maintainer package with around 13 stars, zero dependents, and a last release in November 2020. There is no ecosystem validation, no recent issue activity, and no demonstrated compatibility with current PHP or Symfony versions. Treat it as abandonware and a reference implementation rather than a dependency.
- What does this bundle actually do under the hood?
- It aggregates per-site credentials from Symfony config, builds a Google_Client through google/apiclient, calls setSubject() to impersonate a Google Workspace user, and returns an authenticated client. It contributes configuration plumbing and a container service, not authentication logic. All the real work — setAuthConfig, setScopes, fetchAccessTokenWithAssertion — happens inside google/apiclient, which you can call yourself.
- How do I authenticate my Laravel app to Google APIs without this bundle?
- Reimplement the behaviour natively, which is roughly a day of work. Create one config/google.php file with multiple named connections (analytics, workspace, and so on), each holding credentials_path, subject and scopes. Bind a GoogleClientFactory as a singleton in a service provider and optionally expose a Google facade. You get no Symfony dependency, full ownership, and something you can actually unit test.
- Do I need setSubject and domain-wide delegation, or can I skip impersonation?
- Only use setSubject() when you must act as a specific Workspace user, such as reading their Gmail, Drive or Calendar, which requires a super admin to authorise domain-wide delegation in the Admin console. If you only need Sheets, Analytics or GA4 property access, share those resources directly with the service account and skip impersonation entirely. Many teams discover they need none of this code, in which case there is no case for adoption.
- How should I store Google service account credentials in Laravel?
- Never commit the service account JSON, and avoid dumping the raw blob into .env. Resolve a filesystem path at runtime from a secret store such as Google Secret Manager, Vault or an encrypted store. If you run on GCP, AWS or Azure, consider Workload Identity Federation to eliminate static keys altogether. Wrap access behind a CredentialsRepository interface so the backing store can change without touching call sites.
- What are the security risks of the credential model this bundle uses?
- Service account private keys are long-lived bearer credentials, and combining them with domain-wide delegation scopes creates a privilege-escalation primitive: a leaked key can read any user's mail, drive or calendar. Pinning an old wrapper also drags in an old google/apiclient, Guzzle and firebase/php-jwt chain with historical CVE exposure. Mitigate with minimal scopes, short-lived or federated credentials, and a real rotation process.
- Will installing this bundle conflict with google/apiclient in my app?
- Very likely. The bundle pins older Symfony HttpKernel, DependencyInjection and Config components, and its google/apiclient constraint may not resolve alongside a modern ^2.x release. That can cascade into conflicts with Guzzle and firebase/php-jwt versions your app already requires. Run composer why-not google/apiclient before attempting an install, and expect to abandon it.
- How do I cache Google access tokens in Laravel?
- Access tokens are short-lived, roughly one hour, so cache them in the Laravel cache keyed by connection, subject and a hash of the scope list. That avoids re-signing a JWT and hitting the token endpoint on every request. Invalidate the entry whenever the subject, scopes or credentials change, and handle a 401 by clearing the key and retrying once.
Weaver
How can I help you explore Laravel packages today?