- What is irazasyed/jwt-auth-guard and how does it work with Laravel?
- It is a Laravel and Lumen authentication guard that lets routes use Laravel's native auth middleware while users are authenticated with JSON Web Tokens. It plugs into the guard system and is designed to work alongside tymon/jwt-auth, so guard and middleware usage stays consistent with Laravel's auth configuration. Treat it as a legacy compatibility layer rather than a modern standalone JWT implementation.
- How do I install and configure irazasyed/jwt-auth-guard?
- Install it with Composer, then register its service provider if your Laravel version does not support package discovery for it. Add a guard entry in config/auth.php that uses the package's JWT guard driver and set it as the default or assign it to API routes. Confirm your Laravel, PHP, and JWT dependency versions match the package's Laravel 5.x-era constraints before relying on it.
- Is irazasyed/jwt-auth-guard compatible with Laravel 8, 9, 10, or 11?
- There is no credible support for Laravel 8, 9, 10, or 11; the last release was in April 2016 and the package targets Laravel 5.x-era conventions. On modern Laravel, Composer constraints and changes to guards, middleware, and exceptions are likely blockers. Run composer why-not and a runtime test matrix before considering it, and do not adopt it for new Laravel versions.
- Does irazasyed/jwt-auth-guard work with tymon/jwt-auth?
- Yes, it is intended to work alongside tymon/jwt-auth and uses that workflow for token handling while exposing a Laravel auth guard. You still need to install and configure the underlying JWT provider, including its secret, token TTL, and storage settings. Because both packages are old in this context, verify the exact compatible versions with Composer and automated tests.
- How do I protect routes with the JWT guard and Laravel auth middleware?
- Configure a guard in config/auth.php that uses the package's JWT driver, then apply Laravel's standard auth middleware to the routes you want to protect. Clients send the token, typically as a Bearer token in the Authorization header, and the guard resolves the authenticated user. The benefit is that controllers and middleware can use Laravel's normal auth APIs instead of custom token checks.
- Is irazasyed/jwt-auth-guard maintained and safe for production?
- No, it should not be treated as safe or strategic for new production authentication. The last release was April 2016, and authentication is security-sensitive, so abandoned dependencies, JWT configuration mistakes, and missing security patches are high risks. If a legacy constraint forces adoption, isolate it behind an internal adapter and assign clear ownership for forks, patches, and a removal plan.
- How do I test JWT authentication with this guard?
- Write feature tests that call protected routes without a token and expect a 401, then call them with a valid Bearer token and assert the correct user is resolved. Add cases for expired tokens, malformed tokens, refresh behavior, blacklisting, and custom claims, because those are the areas most likely to differ across versions. Use a version-specific test matrix rather than trusting the README.
- What are the best alternatives to irazasyed/jwt-auth-guard?
- For modern Laravel, use Laravel Sanctum for first-party SPA and API token authentication, or Laravel Passport when you need OAuth2. If JWT is a hard requirement, choose an actively maintained JWT package and verify its security posture, refresh-token semantics, and revocation support. irazasyed/jwt-auth-guard is only reasonable as a legacy bridge when migration is not immediately possible.
- Can I use irazasyed/jwt-auth-guard with Lumen?
- The package describes Laravel and Lumen support, so Lumen usage generally means registering the service provider in the Lumen bootstrap and configuring the auth guard. Lumen's auth and middleware setup differs from Laravel's, and the package's age means only legacy Lumen versions are plausible. Prove compatibility with a small spike before committing.
- How do refresh tokens, blacklisting, and custom claims work with this package?
- Custom claims and token behavior depend on the underlying JWT provider, typically tymon/jwt-auth, rather than on the guard alone. Refresh tokens and blacklisting require correct provider configuration and a reliable revocation store, and the guard's old release means you must test replay, expiry, and revocation explicitly. Do not assume refresh or blacklist semantics from the package description; verify them in your target stack.