- What is juststeveking/http-auth-strategies used for?
- It is a small PHP package for creating HTTP authentication headers through reusable strategy classes, so Basic, Bearer, and custom auth schemes can be encapsulated instead of assembled inline. In a Laravel app it is intended for outbound request header composition, not for validating inbound Authorization headers. The supplied documentation is inconsistent on that point, so confirm the inbound versus outbound scope before adopting it.
- How do I install juststeveking/http-auth-strategies in a Laravel application?
- Install it with Composer using juststeveking/http-auth-strategies, then wire the relevant strategy into the integration that makes the outbound HTTP call. There are no migrations, queue changes, or end-user login changes involved. Check the package composer.json constraints first, because the available release evidence does not clearly document the supported PHP and Laravel matrix.
- Does this package support Laravel 10 or Laravel 11?
- The available evidence does not publish a clear PHP and Laravel support matrix, and the last release date shown is 2020-12-07. You should inspect the Composer constraints and run a spike on your exact Laravel and PHP versions before scoping adoption. Do not assume modern Laravel support without verifying it in your own application.
- What is the difference between BasicStrategy and BearerStrategy in this package?
- BasicStrategy produces a Basic Authorization header from credentials, while BearerStrategy produces a Bearer token header. Laravel's Http facade already offers withBasicAuth and withToken for these cases, so the package adds little for Basic and Bearer alone. Its more differentiated value is the CustomStrategy for long-tail auth schemes.
- Can I use it for API key headers such as X-API-Key or tenant routing headers?
- The CustomStrategy is the commercially interesting part because it targets custom header-based auth such as X-API-Key providers, tenant or routing headers, dated HMAC-style signatures, and legacy key auth. If you allow header names or values from config or request data, constrain names to RFC 7230 token rules and reject control characters in values. That validation matters because the package composes raw HTTP header lines.
- How should I store credentials when using this package?
- Source credentials from environment variables or a secret manager rather than committed configuration, and keep rotation centralized. The package can compose the header, but it cannot solve secret management, audit, or rotation policy for you. Making custom header auth too easy can create a shadow auth layer that escapes central controls.
- Is juststeveking/http-auth-strategies safe for production use with credentials?
- The feature-level blast radius is contained and reversible, but the supply-chain risk is material for credential-handling code: the package has around 8 stars, 0 dependents, a single maintainer, and a last release date of 2020-12-07. Plan for a security review and assume you may need to own or vendor the code. Separate the feature risk from the dependency-risk decision.
- How does this package prevent CRLF header injection?
- The available evidence does not establish how header names and values are validated, so do not pass untrusted input directly into a strategy. Header names should be constrained to RFC 7230 token rules, and values should reject control characters such as carriage returns and line feeds. Verify the implementation during your spike before using it with dynamic configuration.
- What happens when custom strategies and built-in Basic or Bearer strategies coexist?
- Resolution order must be deterministic and observable, especially when multiple strategies could apply to the same integration. An ambiguous order that still appears to work can send the wrong credential to the wrong host. Check whether the package logs or exposes which strategy was selected, and fail loudly if precedence is unclear.
- What alternatives should I consider instead of this package?
- For Basic and Bearer auth, Laravel's Http facade with withBasicAuth and withToken already covers the common cases without an extra dependency. For custom headers you can write a small in-house strategy class or Guzzle middleware, which is a realistic one-to-two-day fallback. The package is most defensible when you have many heterogeneous integrations and want one auditable place to define custom auth headers.