- Is matt-czerner/oauth2-bundle a Laravel package?
- No. It is a Symfony bundle that provides OAuth2 authorization and resource server capabilities. It relies on Symfony's HttpKernel bundle system, DI container, Config component, and typically Symfony Security, so it is not a Laravel package despite Laravel-focused descriptions. Treat it as Symfony-native code.
- Can I install this OAuth2 bundle in Laravel with Composer?
- Composer may resolve the package, but it will not work as a Laravel package. Laravel has no bundle registration or Symfony compiler passes, and the bundle expects Symfony kernel and container semantics. There is no Laravel service provider path like laravel/passport. Do not plan a hybrid Laravel host for a Symfony bundle.
- What Symfony and PHP versions does this OAuth2 bundle support?
- The provided evaluation found no documented supported Symfony/PHP matrix, no CI badge signal, and only a single 2024-07-30 tag. Before adoption, inspect composer.json constraints and test against your target Symfony LTS and PHP versions. Ask the maintainer which versions are actually tested.
- Which OAuth2 grants and flows does this bundle support?
- The overview says it covers authorization-code and token flows and acts as an authorization/resource server. The evaluation does not confirm a full grant matrix such as client credentials, refresh, or device grants. Verify the source and tests for the exact grants you need before designing around it.
- Does it support PKCE, token revocation, introspection, and OIDC discovery?
- These are not confirmed in the provided material. The technical evaluation explicitly lists RFC 7636 PKCE, RFC 7009 revocation, RFC 7662 introspection, and OIDC discovery as questions for the maintainer. Confirm support before relying on it for public clients or third-party integrations.
- How are OAuth2 clients, access tokens, and refresh tokens stored?
- The evaluation does not establish the storage model; it asks whether persistence uses Doctrine ORM or a custom storage interface. It also asks whether token storage is pluggable for a shared Redis or database tier. Check the bundle configuration and storage interfaces before assuming it fits your infrastructure.
- Is this bundle built on league/oauth2-server?
- The evaluation says it most likely delegates protocol correctness to league/oauth2-server, but this is not confirmed in the excerpt. If it does, ask which upstream version is used and how security fixes are surfaced. That upstream version matters more than the bundle wrapper for protocol risk.
- What are the maintenance and security risks of adopting this package?
- The dominant risk is project maturity: zero stars, zero dependents, a single 2024 tag, and an effectively single-maintainer bus factor. There is no evidence of a security disclosure process, supported version matrix, or CI/test signal. For an OAuth2 authorization server, defects can mean token forgery, scope escalation, or credential leakage; MIT licensing lets you fork and vendor, but that creates an owned codebase.
- What should a Laravel team use instead for OAuth2?
- For a Laravel-first estate, use a maintained Laravel OAuth2 integration such as laravel/passport, which is built around league/oauth2-server. Alternatively, use league/oauth2-server with a thin Laravel bridge if you need custom flows. Use Laravel Sanctum for simple API token auth, not as a full OAuth2 authorization server.
- Can I run this Symfony bundle as a separate OAuth2 service for Laravel clients?
- Yes, that is the cleanest viable shape: run it as a standalone Symfony authorization/resource server exposing OAuth2 or OIDC endpoints to Laravel clients. It uses the bundle as designed and keeps a clear boundary, but adds a second runtime and framework to your estate. Do not try to host the bundle inside a Laravel application.