- Is imaximius/forgot-password-bundle a Laravel package?
- No. Although it is distributed on Packagist as a Composer package, it is a Symfony bundle built around Symfony's Bundle class, DependencyInjection extension, event dispatcher and YAML/XML routing. It ships no service provider, no Laravel package auto-discovery and no bindings against Laravel contracts, so it will not function inside a Laravel application as published. Treat it as a Symfony component rather than a Laravel one.
- Can I install imaximius/forgot-password-bundle in a Laravel app with Composer?
- Composer may download the files, but nothing will be wired up, because Laravel only auto-discovers service providers declared under extra.laravel in composer.json and this bundle provides none. You would have to rewrite the controllers, routing, token storage and mailer integration to use Laravel's PasswordBroker, Eloquent and Notifications. At that point you have written the feature yourself and the bundle has contributed only design inspiration. Budget for a port, not an install.
- How do I install and configure imaximius/forgot-password-bundle in Symfony?
- Require it with Composer, register the bundle in config/bundles.php, import its routing file, and set the token lifetime and email templates under the bundle's configuration key. It integrates with Symfony Security and Symfony Mailer, so those components must already be installed and configured in the host application. Configuration details follow the upstream CoopTilleulsForgotPasswordBundle documentation.
- What Laravel versions does this package support?
- None. The package declares Symfony framework and component constraints rather than illuminate/* or laravel/framework constraints, because it targets the Symfony kernel and bundle system. There is no support for Laravel 9, 10, 11 or 12 and no compatibility shim exists. If your composer.json requires laravel/framework, dependency resolution is the first thing to check before spending time on evaluation.
- Is imaximius/forgot-password-bundle safe to use in production?
- The health signals are weak: the last release was January 2021, it has zero stars and zero dependents, and the imaximius namespace is a republication of the CoopTilleuls codebase with no documented diff. Password reset is a security-critical surface covering token entropy, single-use enforcement, expiry and clock handling, account-enumeration resistance, rate limiting and email link host validation. Inheriting that from an unmaintained source with no stated security response commitment is a high risk that requires a full audit first.
- Does imaximius/forgot-password-bundle require Doctrine ORM?
- In most versions the bundle ships Doctrine ORM mappings for the reset token entity and repository, which ties token storage to Doctrine's entity manager. Check the composer.json requirements and the bundle's service definitions to see whether a storage interface is offered, because a Doctrine-agnostic design would materially reduce adaptation effort. This single question often decides whether a port is a day of work or a week.
- What is the difference between this package and coopTilleuls/forgot-password-bundle?
- This repository is a republication of CoopTilleulsForgotPasswordBundle under the imaximius vendor namespace, and the published description does not state what was changed or why. For authentication code, that provenance gap is a supply-chain concern in itself. If your target is Symfony, prefer the upstream package, which has the community visibility, issue history and review that this fork lacks.
- How should I implement forgot-password in Laravel instead?
- Laravel ships the feature in core: the Illuminate\Auth\Passwords broker, the CanResetPassword contract, Password::sendResetLink() and Password::reset(), the password_reset_tokens table, and signed expiring notification URLs. Add the Notifiable trait and a ResetPassword notification and you have a maintained, security-reviewed implementation with no third-party dependency. Evaluating a Symfony bundle for this requirement is a net-negative trade.
- Does the bundle generate secure tokens and enforce expiry?
- Yes, within its Symfony context: it generates secure reset tokens, persists them, enforces a configurable lifetime, and validates the token before allowing a password change, with email delivery through Symfony Mailer and configurable templates. None of those guarantees transfer to Laravel, and the 2021 release predates current PHP 8.2 and 8.3 idioms as well as recent framework security patches. Verify the token generation and expiry code yourself before trusting it.
- How do I test the password reset flow in this bundle?
- Its controllers and services are ordinary Symfony services, so they can be exercised with functional tests against the reset-request and reset routes using Symfony's KernelBrowser and a mailer transport that captures messages. Because the latest release is from 2021, confirm the test suite runs against your PHP and Symfony versions before relying on it. If you reimplement the design in Laravel, test against the Password facade and Notification::fake() instead.