- Can I install hashnz/hawk-server-bundle in Laravel with Composer?
- No, not as a normal Laravel dependency. It is a Symfony bundle built around HttpKernel, DependencyInjection extensions, and config trees that Laravel does not load. Composer may resolve code, but there is no Laravel service provider or middleware registration path. Treat the Hawk verifier as reference source rather than an installable package.
- Does hashnz/hawk-server-bundle support Laravel 10 or 11?
- There is no Laravel 10 or 11 support because this is a Symfony bundle, not a Laravel package. The provided assessment also warns its PHP and symfony/* constraints likely conflict with PHP 8.2+ and modern Symfony components used by Laravel. Check composer.json and the last commit date before assuming it can coexist in a Laravel 10 or 11 app. Do not expect a service provider, facade, or publishable Laravel config.
- How do I add Hawk authentication to Laravel using this package?
- You would not register the bundle. The practical path is to read its Hawk header parser and MAC verifier, then implement Laravel middleware plus a credential repository and nonce store. That port is usually a few hundred lines, not a composer require step. Plan a security review and interop tests because you are copying crypto logic.
- What does the Hawk server bundle verify?
- Its stated purpose is server-side Hawk authentication: parse the Authorization Hawk header, verify the MAC, check timestamp skew, and track nonces. The Hawk header includes id, ts, nonce, mac, and optionally ext. Payload-hash validation is not confirmed by the excerpt, so inspect the source before relying on it.
- Is the Hawk MAC comparison constant-time in this bundle?
- The excerpt does not show the implementation, so you must read the verifier before trusting it. Constant-time comparison is essential for Hawk MAC verification; a bare equality check is a common flaw in homegrown implementations. If it uses hash_equals or an equivalent, that is the right behavior. If not, replace it before using any ported code.
- How does nonce replay protection work across multiple Laravel servers?
- The bundle's nonce handling details are not shown, and the key question is whether nonce storage is pluggable or in-process. In-process nonce tracking provides no replay protection across a multi-node fleet. For Laravel, bind a HawkNonceStore to Redis or your cache and enforce the same skew window on every node. Confirm the bundle fails closed when nonce storage is unavailable.
- Is hashnz/hawk-server-bundle maintained and safe for production?
- The provided assessment reports zero stars, zero dependents, a one-line description, and no visible CI or tests. Security-sensitive crypto code without a visible test suite is a hard stop until reviewed. There is also no evidence of an active upstream maintainer, so any flaw you find becomes yours to fix and disclose. For Laravel production use, depend on maintained auth packages rather than this bundle.
- What Laravel authentication alternative should I use instead of Hawk?
- For Laravel APIs, use Sanctum for first-party tokens or Passport for OAuth2, and consider mTLS or signed requests for service-to-service auth. Hawk was a Mozilla-originated draft that never became a standard and has little ecosystem momentum today. Only choose Hawk if a partner already requires interop. Otherwise you are adopting a protocol with few developers and little documentation.
- Can I port the Hawk bundle code into Laravel middleware?
- Yes, that is the realistic approach if you must support Hawk. Extract the header parser, canonical request builder, HMAC verification, timestamp check, and nonce logic into Laravel middleware. Discard the bundle's DependencyInjection and Resources/config directories. Bind a credential repository to your key store and a nonce store to Redis, then add interop and replay tests.
- How should I test Hawk authentication in Laravel?
- Test with known Hawk test vectors plus generated requests that cover valid MACs, bad MACs, stale timestamps, replayed nonces, missing fields, and ext handling. Include payload-hash cases if your implementation supports them. Run the same suite against a real Hawk client or reference implementation to confirm canonicalization. Also test behind your proxy setup, because payload hashing and URL reconstruction are common failure points.