- Does janakdom/jwt-refresh-token-bundle work with Laravel?
- No. It is a Symfony bundle and assumes Symfony bundle registration, the DI container, security firewall configuration, and typically Doctrine for token storage. There is no Laravel service provider, config publish path, or middleware group. For Laravel, use Sanctum or Passport, or build a custom refresh-token flow on top of tymon/jwt-auth.
- What does janakdom/jwt-refresh-token-bundle actually do?
- It adds refresh token support to JWT-based Symfony applications so API clients can exchange a stored refresh token for a new access token without forcing users to log in again. It includes a refresh endpoint, configurable token lifetimes, rotation and revocation, and Doctrine-backed persistence. It is designed to sit alongside common Symfony JWT authentication bundles such as Lexik.
- How do I install and register the bundle in a Symfony app?
- Install it with Composer, register the bundle in bundles.php or services.yaml, then configure the refresh token entity, migration, firewall entry, and token endpoint. It is intended to complement an existing Lexik JWT setup. Before committing, verify the composer.json constraints resolve against your Symfony, Lexik, and Doctrine versions.
- Which Symfony, PHP, Lexik, and Doctrine versions are supported?
- The package context does not confirm a tested compatibility matrix, and the zero-dependents signal means its version claims have not been exercised widely. Treat composer.json constraints as aspirational until you run a spike against your lockfile. Watch for conflicts with Lexik major versions and in-flight Doctrine migrations.
- Is Doctrine ORM required for storing refresh tokens?
- The bundle is described as Doctrine-backed, so Doctrine ORM or DBAL is expected for persistence. It is not clear from the available context whether a custom storage adapter is supported. Confirm that requirement in the source before planning an integration.
- Does it implement refresh token rotation with reuse detection?
- The overview mentions token rotation and revocation, but it does not confirm replay or reuse detection. That distinction matters for security-critical refresh token flows. Read the source and test rotation, reuse, and expired-token cases before relying on it.
- How do I revoke a refresh token or handle logout?
- The bundle advertises a revocation path, but you should verify how revoked tokens are stored and checked at the endpoint. Test that revocation still works after signing-key rotation and under clock skew. If the behavior is incomplete, wrap it behind your own TokenRevoker interface.
- Is this package a fork of gesdinet/jwt-refresh-token-bundle?
- The name strongly suggests a re-publish or fork of gesdinet/jwt-refresh-token-bundle or an older markitosgv fork, but that is not confirmed in the provided context. Confirm provenance and diff the source before any further spend. The upstream gesdinet bundle is the better-known Symfony option to compare against.
- Is it safe for production with zero stars and no dependents?
- The maturity signals are weak: no stars, no dependents, a single-maintainer appearance, and no visible security disclosure process. For refresh-token rotation and revocation code, that is a poor dependency of record. If you must use it, vendor or fork the source and own the implementation behind internal interfaces.
- What are the best alternatives for JWT refresh tokens in Laravel or Symfony?
- For Symfony with Lexik, use gesdinet/jwt-refresh-token-bundle as the established option. For Laravel, prefer Sanctum for first-party API tokens or Passport only when OAuth2 grants are required; tymon/jwt-auth plus a custom refresh-token table is another path. In a polyglot estate, keep this bundle scoped only to Symfony services that already use Lexik.