- Can I install mopa/wsse-authentication-bundle in Laravel?
- No. It is a Symfony2 bundle built on Symfony Security component classes such as AuthenticationProvider, a firewall listener, WsseToken, and a nonce cache, none of which exist in Laravel's guard and middleware model. There is no integration path for composer requiring it into a Laravel application. Treat it only as a reference implementation for the WSSE UsernameToken digest and replay-protection pattern.
- How does WSSE authentication with X-WSSE headers actually work?
- The client sends an Authorization: WSSE profile="UsernameToken" header containing a Base64-encoded UsernameToken with Username, PasswordDigest, Nonce, and Created fields. The server verifies Base64(SHA1(nonce + created + password)), validates the Created timestamp against an allowed clock-skew window, and records the nonce in a TTL cache to block replay. The scheme is stateless apart from the shared nonce store.
- Does WSSE authentication work with bcrypt or argon2 password hashes?
- No. The standard WSSE digest requires the server to hold the plaintext password so it can recompute SHA1(nonce + created + password), which is incompatible with bcrypt, argon2, or any one-way hash. If you build this, you must deviate from the spec using an HMAC with a stored per-client secret or scope WSSE strictly to a dedicated API-credential table that never touches user passwords. For end-user credentials, use OAuth2, Passport, or a signed-request scheme instead.
- Is mopa/wsse-authentication-bundle maintained and safe for production?
- No. It has roughly 18 stars, 0 dependents, and a health score around 0.27, with code targeting PHP 5.3-era syntax and Symfony 2.0/2.1 APIs that were removed years ago. There is no upstream maintenance, no security response process, and no compatibility work for PHP 8.x or Laravel 10-11. Anything you ship based on it is a fork you own permanently.
- How do I implement WSSE authentication in Laravel without this bundle?
- Build it greenfield as a WsseAuthenticate middleware on the relevant API route group: parse the Authorization header, Base64-decode the UsernameToken, verify the digest, check the Created skew window, and store the nonce in a Redis-backed Illuminate\Support\Facades\Cache store with a TTL. Use a dedicated WsseCredential model for client id, secret or key, active flag, and allowed clock skew. The middleware should resolve the client and call Auth::setUser() or simply authorize the request instead of trying to graft Symfony's AuthenticationProvider semantics onto Laravel's Guard.
- Why is replay protection critical for WSSE and how do I get it right in Laravel?
- A captured WSSE token can be replayed within the allowed clock-skew window unless the server records each nonce in a shared, atomic TTL cache. A per-node in-memory cache silently defeats the entire scheme behind a load balancer. Use Redis through Illuminate\Support\Facades\Cache with an atomic add operation such as Cache::add and a TTL at least as long as the skew window, and fail closed if the cache is unavailable.
- Which Laravel and PHP versions can use mopa/wsse-authentication-bundle?
- None reliably. The package targets PHP 5.3-era syntax and Symfony 2.0/2.1 APIs, so it is not compatible with PHP 8.x or Laravel 10-11. Even on legacy Symfony it is a bundle, not a Laravel package, so there is no supported Laravel version. For modern Laravel, reimplement the protocol pattern rather than depending on this package.
- What are the alternatives to WSSE for Laravel API authentication?
- The usual alternatives are Laravel Passport for OAuth2, Sanctum for first-party token authentication, HMAC signed-request schemes, or mutual TLS for service-to-service traffic. If the client only needs stateless header authentication, you control the algorithm and can avoid the plaintext-password problem entirely. Adopting WSSE broadly is an architectural regression compared with OAuth2 or signed requests.
- How much work is it to port WSSE UsernameToken verification to Laravel?
- The protocol logic worth harvesting is small, roughly 200 to 400 lines: parse the header, decode the UsernameToken, verify the digest, validate Created, and record the nonce. Reimplementing it as a Laravel middleware plus a custom guard is about a 3 to 5 day task for one engineer including test coverage. Capture fixtures from the real client's test environment first and confirm exact header formatting before writing code.
- What should I check before copying code from MopaWSSEAuthenticationBundle?
- Confirm the license and code provenance before copying anything into your tree. Clarify whether the requirement mandates the exact UsernameToken digest or only stateless header authentication, and whether the credential set is service-to-service API keys or end-user passwords, because that determines whether the digest variant is viable at all. Also identify the specific client demanding WSSE, any hard contract deadline, and who owns the fork long-term, since the upstream project is abandoned.