Weave Code
Hash Compat Laravel Package
indigophp/hash-compat
Provides a hash_equals() polyfill for PHP versions older than 5.6, where the native timing-attack-safe string comparison function isn't available. A small compatibility shim for legacy projects.
indigophp/hash-compat backports PHP’s native hash_equals() function to older PHP runtimes, enabling timing-safe string comparisons without requiring PHP 5.6+. It is useful for validating password-reset tokens, HMAC signatures, and other secret values where ordinary === comparisons could leak timing information.
- Provides a
hash_equals()polyfill for legacy PHP versions - Performs constant-time comparison to reduce timing-attack risk
- Safely handles strings of different lengths
- Loads automatically via Composer
- Leaves the native function untouched when already available
Frequently asked questions about Hash Compat
- What does indigophp/hash-compat actually do?
- It is a function-level polyfill that backports PHP's hash_* functions, including hash_equals and hash_pbkdf2, to older PHP runtimes that lack them. Composer loads it as a files autoload shim, and each declaration is guarded with function_exists so existing native implementations are left untouched. There is no service provider, config file, facade, or container binding, so it adds no framework surface area. It exists purely so legacy code can call modern hashing APIs without conditional checks.
- How do I install indigophp/hash-compat in a Laravel project?
- Install it with Composer using composer require indigophp/hash-compat. Because it is a files autoload shim, no Laravel registration step is needed; the functions become available as soon as the Composer autoloader is included. There is nothing to publish and no environment variables to configure. After install, verify the functions resolve in tinker or a quick script before relying on them.
- Which PHP versions need this hash compatibility package?
- It targets PHP below 5.6 for hash_equals and below 5.5 for hash_pbkdf2. On PHP 5.6 and later, hash_equals is native and this dependency should be deleted outright with zero code changes. If your estate has no PHP 5.3 through 5.5 runtimes, the package is dead weight and audit noise. It is only justified as a stopgap for a runtime you cannot upgrade yet.
- Does indigophp/hash-compat work with Laravel 4 and Laravel 5?
- Yes. It is framework-agnostic and only requires Composer, so it drops into Laravel 4.2 and Laravel 5.0 through 5.1 without modification. It does not belong in any PHP 7 or PHP 8 service, where the functions are already native. Shipping it to a modern Laravel application provides no benefit and creates unnecessary redeclaration risk during future upgrades.
- Is indigophp/hash-compat still maintained?
- No. The last release was 2015-08-22, the repository is not resolvable from the package metadata, and there is no visible CI, commit history, or security response path. It will not appear in normal advisory feeds, and no fix will ever ship. Treat it as archived code and plan its removal rather than adopting it as a long-term dependency.
- Is the hash_equals polyfill safe against timing attacks?
- That cannot be confirmed from the available metadata because the source is not reviewable. A naive PHP implementation of hash_equals can introduce a timing side channel while appearing to fix one, which is the worst outcome for a security-motivated dependency. Cryptographic polyfills must be constant-time and spec-correct. Obtain and review the source before adoption, or use a maintained alternative.
- What is the difference between this package and symfony/polyfill-php56?
- Both cover the same gap, but symfony/polyfill-php56 is maintained and widely audited, while indigophp/hash-compat is archived with no maintainer. The context recommends substituting the Symfony polyfill when an upgrade is genuinely blocked. The Symfony package gives you an active security process instead of unverified crypto code. Choose the maintained polyfill unless you have a specific reason to fork this one internally.
- Can indigophp/hash-compat cause fatal redeclaration errors in production?
- Yes, it can. Any polyfill that declares global functions is order-sensitive, so if another polyfill such as Symfony's declares hash_equals or hash_pbkdf2 first, behavior depends on autoload ordering and can produce fatal redeclaration errors. This class of bug often surfaces late and inconsistently across environments. Audit the full dependency tree for duplicate declarations and resolve the ordering or remove the duplicate entirely.
- What should I test before using this hashing polyfill?
- Confirm in a staging build whether the functions are declared globally or namespaced, and verify behavior against native PHP 5.6 for edge cases. Test non-string arguments, multibyte input, empty strings, and algorithm availability for hash_pbkdf2. Also check that other polyfills in the dependency tree do not declare the same functions. These checks catch the differences that matter when a polyfill stands in for native crypto behavior.
- How do I remove indigophp/hash-compat from a legacy Laravel app?
- The preferred path is to upgrade the runtime to PHP 5.6 or later, at which point hash_equals is native and you can delete the dependency with no code changes. If the upgrade is blocked, replace it with a maintained polyfill such as symfony/polyfill-php56. As a last resort, fork the package into an internal namespace, pin a specific commit, and treat the fork as first-party code subject to review and patching. Assign an owner and a removal date so the dependency does not linger indefinitely.
Weaver
How can I help you explore Laravel packages today?