Weave Code
Hmac Bundle Laravel Package
ibrows/hmac-bundle
ibrows/hmac-bundle provides HMAC-based authentication for Symfony/PHP applications, letting you sign and verify requests with shared secrets to secure APIs and protect endpoints from tampering and unauthorized access.
At a glance
Frequently asked questions about Hmac Bundle
- Can I use ibrows/hmac-bundle in a Laravel application?
- No, not as a working dependency. The package is a Symfony bundle (IbrowsHmacBundle) that registers through a Symfony kernel and DI extension, and Laravel has no bundle registry or equivalent container extension. Composer require will succeed, but nothing will autoload into Laravel's service container and no middleware will attach to the HTTP stack. Treat it as a reference specification for HMAC signing and reimplement the pattern natively in Laravel.
- Why does the package not register a service provider or middleware in Laravel?
- Because it was never built for Laravel. It ships a Bundle subclass plus a DependencyInjection Extension and wires its signing and verification logic through Symfony kernel event listeners. Laravel's package discovery expects service providers and HTTP middleware, neither of which exists here. The bundle plumbing (service XML, config tree, event subscriber registration) is Symfony-specific and would be discarded in any Laravel port.
- What does ibrows/hmac-bundle actually do for HMAC request signing?
- It adds HMAC-based request signing so clients and servers can prove message integrity and authenticity using a shared secret, without transmitting the secret itself. Requests are signed with a configurable hash algorithm and verified during the Symfony request lifecycle via kernel event listeners. It also includes timestamp and nonce validation for replay protection, with configurable headers, keys, and route exclusions.
- How do I implement HMAC request signing natively in Laravel instead?
- Build a small Signer service that constructs a canonical request string from method, path, sorted query parameters, and a body digest, then signs it with hash_hmac. Add a VerifyHmacSignature middleware that rebuilds the canonical string from the incoming request and compares signatures with hash_equals, which is timing-safe. Store nonces in Redis or the cache with a TTL matching your timestamp tolerance, and source keys from a secret manager rather than .env. Expect roughly 150 to 300 lines of owned, testable code.
- Does the bundle provide replay protection through timestamps and nonces?
- Yes, timestamp and nonce validation is a stated feature, but the bundle does not prescribe a nonce backend, TTL, or eviction strategy. In a Laravel port you would pair the timestamp tolerance with a cache or Redis nonce store that expires entries automatically. You also need an explicit clock-skew policy, since that decision controls how much replay window you are accepting.
- Is ibrows/hmac-bundle still maintained, and which Symfony and PHP versions does it support?
- The repository shows zero stars, zero dependents, and no meaningful release cadence, which strongly suggests it is unmaintained. The codebase appears pinned to Symfony 2 or 3 era patterns such as ContainerAware services and likely will not run on PHP 8.2+ with Symfony 6 or 7. Confirm the last release date and supported PHP/Symfony matrix from the repository before relying on it anywhere.
- Is it safe to use in production to secure APIs?
- It is high risk for a security-critical component. With zero dependents there is no peer review, no CVE visibility, and no disclosure channel, and the cryptographic details have not been independently audited. The subtle parts are exactly the parts you cannot verify without tests: hashing the raw body before deserialization, canonical ordering of duplicate query parameters, chunked transfer encoding, and nonce store semantics. Copying from an unmaintained security package carries an implicit assumption that the logic was correct when written.
- Does it use a timing-safe comparison and which hash algorithm does it default to?
- The hash algorithm is configurable, but the default digest and the comparison method are not documented in the overview, so you must read the source to confirm. Check specifically whether verification uses hash_equals or a loose == comparison, because a non-timing-safe check undermines the whole scheme. Also check the assumed default key length before reusing any convention from this bundle.
- Can I copy the signing logic from ibrows/hmac-bundle into my own Laravel codebase?
- The license is permissive, so you can reuse the logic provided you retain the copyright notice and license text. In practice the portable part is just the canonicalization convention, header names, and digest handling, since the Symfony plumbing will be thrown away. Keep the attribution in a NOTICE or LICENSE file and write your own tests around the copied conventions rather than trusting them.
- How does this compare to Laravel Sanctum, Passport, or signed URLs?
- Laravel already ships the adjacent primitives: hash_hmac and hash_equals for signing, signed URLs for tamper-evident links, and Sanctum or Passport for token-based API auth. A custom HMAC middleware only makes sense when you need server-to-server request signing with a shared secret and replay protection that token auth does not give you. For most Laravel APIs, Sanctum covers the use case with far less surface area than porting an unmaintained bundle.
Weaver
How can I help you explore Laravel packages today?