- Is morozovsk/websocket a Laravel package, and how do I integrate it with a Laravel app?
- No, it is not a Laravel package in any structural sense. There is no service provider, facade, config file, Artisan command, or publishable migration, and the Yii/Yii2 integration it advertises is only a thin bootstrap shim with no Laravel equivalent. You integrate it by writing a console command that instantiates the server class and running that command as a long-lived daemon under Supervisor, outside the Laravel request/response cycle.
- Does morozovsk/websocket support PHP 8 and current Laravel versions?
- Treat PHP 8 support as an assumption rather than a verified fact. The last tagged release is from February 2017, in the PHP 7.0/7.1 era, so running it on PHP 8.2 or 8.3 means accepting unpatched deprecations and behavior changes in code that parses untrusted binary input at the network edge. Laravel version compatibility is irrelevant in the sense that the library never touches the framework, but any bridge code you write must run on the PHP version your Laravel app requires.
- How do I install and run the WebSocket server in production?
- Install it with Composer and launch it as a standalone PHP CLI process, typically from a custom Artisan command or a plain PHP script. In production you should supervise it with Supervisor or systemd so it restarts on crash, and configure a graceful-shutdown path so deploys do not sever live connections mid-session. The demo setup is not the production setup: supervision, logging, and restart policy are all your responsibility.
- How do I broadcast Laravel events or notifications to WebSocket clients?
- The package provides no transport between your Laravel application and the daemon, because the server runs in a separate process with its own memory space and lifecycle. You must build and own a bridge such as Redis pub/sub, along with a message envelope contract and a reconnect or backfill strategy for clients that were offline. The library effectively contributes only the socket framing layer, which is the smallest part of a real-time feature.
- How do I authenticate users on the WebSocket handshake?
- You have to build it yourself. The connection must be tied to a Laravel session or a Sanctum/Passport token before it is trusted, and you should add origin validation, per-connection authorization for channel subscriptions, and rate limiting. None of this is exotic, but each item is a discrete work package with its own test burden that the package does not cover.
- How many concurrent WebSocket connections can this PHP server handle?
- The server uses single-threaded blocking I/O over stream_select(), so one slow handler stalls every connected client. That shape is fine for dozens of connections and marginal past a few hundred, but it is the wrong architecture for thousands. If your concurrency target is in the thousands, use a maintained alternative such as Laravel Reverb, Soketi, or Centrifugo.
- Does morozovsk/websocket handle SSL/TLS and the RFC 6455 handshake?
- It implements the RFC 6455 handshake and frame codec, supports SSL, text and binary frames, and event-driven handling with minimal dependencies. In practice you should still terminate TLS at a reverse proxy rather than in the PHP process. That also keeps certificate management and HTTP-level filtering out of an unmaintained socket daemon.
- What are the best alternatives to morozovsk/websocket for Laravel real-time apps?
- Laravel Reverb, Soketi, and Centrifugo are all maintained and ship with Laravel and Laravel Echo clients, which removes the bridge, presence, and scale-out work you would otherwise own. Ratchet is another mature PHP option if you want to stay in PHP. Before choosing this package, document specifically why those alternatives are disqualified, whether on licensing, hosting constraints, or familiarity.
- Is morozovsk/websocket safe and maintained enough for production?
- The dominant risk is abandonment, not code quality, since the last release was in 2017 with no visible security response process. A socket server is security-sensitive by nature: handshake parsing, frame length validation, masking, and payload limits are exactly the surfaces where an unmaintained parser is least acceptable. Have legal review the license and get an explicit answer on who owns this daemon at 3 a.m. before committing.
- Does it work with Yii or Yii2, and what about heartbeat and dead connection handling?
- Yes, the repository includes Yii and Yii2 integration, but that integration is only a thin bootstrap shim and gives you nothing for Laravel. Heartbeat/ping-pong, dead-connection reaping, structured logging, and a graceful-shutdown path are not provided as production features and must be implemented by you. Plan for unbounded in-memory connection state as well, since the process is designed never to restart.