Weave Code
Token Bundle Laravel Package
innobyte/token-bundle
A PHP token bundle for generating, storing, and validating tokens through a simple API. Useful for token-based workflows and lightweight integration into Laravel or other PHP applications, with configurable handling for common token use cases.
A Symfony2 Bundle implementing an access-based token system, with generation, validation and consumption mechanisms.
Frequently asked questions about Token Bundle
- Can I install innobyte/token-bundle in Laravel?
- No, not directly. It is a Symfony 2 bundle with no Laravel service provider, facade, config file, or publishable migrations, so Laravel will not boot any of it. Composer resolution will likely fail because Symfony 2-era constraints conflict with the Symfony 6 or 7 requirements of Laravel 9, 10, and 11. Treat it as a design reference and reimplement the token lifecycle in Laravel.
- Is innobyte/token-bundle a Laravel package or a Symfony bundle?
- It is a Symfony bundle. It integrates through AppKernel registration, Symfony DI XML or YAML service definitions, and Doctrine mappings. There is no Laravel package scaffolding, no ServiceProvider, and no Facade. That framing mismatch should be resolved before estimating any integration work.
- What is innobyte/token-bundle used for?
- It generates and validates signed, time-limited tokens tied to an entity or payload, with configurable TTL and optional single-use behavior. Typical uses are magic links, password resets, API access, and one-time actions. In Laravel you would normally implement those with native features or a small custom tokens table.
- Does innobyte/token-bundle support Laravel 9, 10, or 11?
- No. Laravel 9, 10, and 11 require symfony/* ^6 or ^7, while this bundle targets Symfony 2-era dependencies, so Composer will likely report a hard conflict. PHP version ceilings are also plausible. Do not plan a direct install; reimplement the concept if you need it.
- How do I implement secure time-limited tokens in Laravel without this bundle?
- Use Laravel's native tools: the password broker for resets, signed URLs for time-boxed links, and Sanctum or Passport for API tokens. For bespoke single-use tokens, create an Eloquent model with token_hash, scope, expires_at, and consumed_at. Generate tokens with random_bytes or Str::random(64), compare with hash_equals, and consume atomically with a conditional update where consumed_at is null.
- What security concerns should I review before using innobyte/token-bundle?
- Focus on token-at-rest handling, entropy, constant-time comparison, atomic single-use enforcement, expiry, scope binding, and revocation. The bundle has zero adoption signal and no public security review trail, so its crypto and concurrency behavior is unvalidated. Any reimplementation must hash tokens at rest and enforce consumption in the database, not in a read-then-write race.
- Is innobyte/token-bundle actively maintained?
- No. The last release was January 2022 with a Symfony 2 target, meaning it was already legacy at publication. Symfony 2.8 reached end of life in November 2018, so its dependency tree receives no upstream security patches. There are no stars, dependents, or known production consumers.
- Can I fork innobyte/token-bundle and port it to Laravel?
- You can, but it is usually the wrong trade-off for Laravel. A port means rewriting the DI layer as a service provider and mapping Doctrine to Eloquent, while inheriting the upstream security posture and design assumptions. Concept extraction into 150 to 300 lines of idiomatic Laravel code is lower risk and gives you full control over hashing, atomic consumption, and purge jobs.
- How should I design a tokens table for single-use tokens in Laravel?
- Use columns for id, token_hash as unique and indexed, scope, subject_type and subject_id, expires_at, consumed_at, metadata JSON, and timestamps. Issue a random token, store only its hash, and return the plaintext once. On verification, hash the presented token, compare with hash_equals, check expiry and scope, then consume with an atomic update that filters on consumed_at being null. Add a scheduled purge for expired and consumed rows.
- What Laravel-native alternatives cover magic links, password resets, and API tokens?
- Laravel covers most cases natively: the password broker for reset flows, signed URLs for time-boxed links, Sanctum or Passport for API tokens, and a small custom tokens table for invitations, magic links, and one-time downloads. These have higher assurance, active maintenance, and framework-idiomatic testing. Introducing a Symfony 2 bundle creates a durable architectural seam with no offsetting benefit.
Weaver
How can I help you explore Laravel packages today?