Jwt Refresh Token Bundle Laravel Package

Product Decisions This Supports

• Session security roadmap. The core capability — binding a refresh token to a client "fingerprint" so a stolen token can't be replayed from another device — is a concrete answer to a recurring security backlog item (OWASP ASVS token-binding guidance, "log out all other devices," device management screens, step-up auth triggers).
• Build vs. buy vs. fork. This artifact is best treated as a reference diff, not a dependency. It answers "how much work is device-bound refresh, really?" — and the answer is "small," which argues for building the fingerprint layer on top of a maintained upstream rather than adopting a fork.
• Feature scoping for auth UX. Fingerprinting creates a support-cost tradeoff (false-positive logouts behind NAT, CDNs, and mobile IP churn). Reading this implementation lets you decide between hard rejection, soft binding (log + step-up), or user-agent-only binding before committing to a design.
• Use cases it enables. Long-lived sessions for SPA/mobile clients against a Symfony API: short-lived access tokens, revocable refresh tokens, per-device session revocation, and "trusted device" lists.
• Roadmap de-risking. The maintenance profile (0 stars, 0 dependents, last release Feb 2020) is a useful forcing function to revisit whether authentication primitives should ever live in an unmaintained third party — and to put a dependency-policy line item on the roadmap.

When to Consider This Package

Consider it when:

• You run a Symfony application already on gesdinet/jwt-refresh-token-bundle and need to understand or port device binding.
• You want to read the patch, not install it — it's a small, legible example of hashing request attributes into the stored refresh token record and comparing on refresh.
• You're doing a timeboxed spike or internal tool where a vendored fork is acceptable and someone owns it.
• You need a worked example of the failure mode (IP-based fingerprints breaking mobile sessions) to argue for a softer binding strategy.

Look elsewhere when:

• Your stack is Laravel. This is Symfony-only despite the PHP framing; the Laravel equivalents are Sanctum, Passport, or tymon/jwt-auth with a custom refresh guard. This package is not a fit at all.
• It's a new build. Use the actively maintained upstream gesdinet/jwt-refresh-token-bundle (or Lexik + a custom refresh flow) and implement fingerprinting as a thin listener. You inherit Symfony 5/6/7 and PHP 8 compatibility, CVE response, and community review for free.
• Security is audited or regulated. 0 stars and 0 dependents means zero external scrutiny of auth code; the 2020 release predates current Symfony/PHP versions; SOC 2 / PCI / SBOM processes generally forbid unmaintained forks in the login path.
• You need robust device identity. IP+user-agent fingerprints are brittle; if the requirement is real device trust, look at mTLS, DPoP/sender-constrained tokens, or per-device opaque tokens in Redis.
• You want rotation and reuse detection — the stronger control — which this bundle does not add.

How to Pitch It (Stakeholders)

Executives: This is not a purchase recommendation. It's a zero-star, zero-dependent, unmaintained fork of a popular Symfony auth bundle — the value is the idea, not the artifact. The idea (bind refresh tokens to a device so stolen tokens are useless) is worth adopting; the code is worth roughly one to three engineer-days to reimplement on a maintained library. Putting an abandoned fork into the login path would be a supply-chain risk with no offsetting benefit.

Engineering: The upstream gesdinet bundle issues DB-backed refresh tokens that are reusable until TTL, which means a leaked token stays valid for its full lifetime from anywhere. This fork adds a fingerprint hash checked at refresh time — a small subscriber plus a column. Take that diff, apply it to the maintained upstream, and pair it with token rotation and reuse detection, which is the stronger control. Prefer soft binding (log anomalies, trigger step-up auth) over hard rejection, and avoid IP-only fingerprints; they will generate support tickets from mobile and corporate-NAT users.

The one-line version: steal the pattern, not the package.