Wsse Authentication Bundle Laravel Package

Product Decisions This Supports

• Build vs. buy for WSSE client authentication. The package is small enough that "buy" mostly means "copy the pattern." The real decision is whether to vendor a dependency at all versus writing ~100–150 lines of header-signing code in-house. Given 18 stars and 0 dependents, this leans strongly toward "build, using this as a reference."
• Legacy/partner integration roadmap. WSSE (the X-WSSE header with UsernameToken, PasswordDigest, Nonce, Created) shows up almost exclusively in enterprise SOAP endpoints, payment gateways, and older B2B partner APIs. This package is a signal that such an integration exists in your roadmap, not a solution for it.
• Scope decision: WSSE support vs. modern auth. Forces an explicit call on whether WSSE is a one-off integration shim or a supported auth mode. Recommend the former — a narrow adapter behind an interface, not a first-class auth driver.
• Use case fit. Valid only for outbound requests to WSSE-required APIs. It is not a fit for consumer-facing login, session management, or anything you'd expose to your own clients.
• Reference-implementation value. Its most defensible product use is as a spec artifact: it demonstrates canonicalization of the digest, nonce generation, and Created timestamp formatting, which are the exact details teams get wrong.

When to Consider This Package

Consider it (as a reference, not a dependency) when:

• You must call a SOAP/REST endpoint that requires an X-WSSE UsernameToken header and you need a known-good example of the digest and nonce construction.
• You are maintaining an existing Symfony 2.x application (the bundle's actual target) and need WSSE in a hurry with minimal code.
• You need to enumerate edge cases — clock skew tolerance, nonce replay caching, ISO-8601 Created formatting — before writing your own implementation.

Look elsewhere — or rather, do not adopt — when:

• You are on Laravel. This is a Symfony 2 bundle with service-container, security-firewall, and DI-extension wiring. There is no path to using it in Laravel without effectively rewriting it. The "Laravel/PHP package" framing is inaccurate; treat it as PHP-flavored pseudocode only.
• You are on Symfony 4+. Symfony 2 bundles are not compatible with modern Symfony; the security and DI layers changed substantially.
• Security posture matters. 18 stars and 0 dependents means no community scrutiny, no disclosed-vulnerability pipeline, no maintenance signal. WSSE's PasswordDigest scheme also generally requires retaining the plaintext or reversibly-stored secret server-side — a material security decision that deserves explicit review, not inheritance from an unmaintained bundle.
• You need replay protection or key rotation. The bundle's scope is header generation; nonce-cache/replay defense and credential rotation are your responsibility regardless.
• You want long-term support. Assume abandonment. Budget for owning the code from day one.

How to Pitch It (Stakeholders)

To executives: We evaluated this package for a partner/legacy API integration requiring WSSE authentication. It is a Symfony 2-era bundle with negligible adoption and no maintenance signal, and it does not run on our stack. Recommendation: do not add it as a dependency. Instead, our engineers will implement the WSSE header signing in-house using this as a documented reference — roughly one to two days of work, no new third-party dependency, no security review burden, and full ownership of the code. The product risk we are not taking is inheriting an unmaintained auth component into a security-adjacent path.

To engineering: Treat this repo as a spec, not a library. It shows how to build UsernameToken (Username, PasswordDigest = Base64(SHA1(Nonce + Created + Password)), Base64 Nonce, ISO-8601 Created). Implement it as a small, tested client-side signer behind an interface: inject credentials, generate a cryptographically random nonce per request, allow configurable clock-skew on Created, and add a server-side nonce cache only if we are also receiving WSSE. Do not replicate the bundle's Symfony wiring.

Bottom line: Opportunity score (0.6) is inflated relative to adoption (18 stars, 0 dependents, 0.27 overall). The idea is more valuable than the artifact. Use it to inform a decision; do not let it into the dependency graph.