- Is ns/token-bundle compatible with Laravel?
- ns/token-bundle is a Symfony bundle, not a Laravel package. It likely depends on Symfony's DI container, bundle configuration, and security firewall conventions that do not map cleanly to Laravel service providers, middleware, or guards. Direct Composer installation will not make it a Laravel auth solution, so assume incompatibility until a time-boxed spike proves otherwise.
- Can I install ns/token-bundle in a Laravel app with Composer?
- Composer may install the package, but installation alone does not provide Laravel integration. You would still need Symfony container or bundle infrastructure, or a custom adapter layer. Without documented Laravel support, treat it as a Symfony-only dependency rather than a drop-in Laravel auth package.
- What does ns/token-bundle actually do?
- It is a Symfony bundle for token-based authentication that helps generate, store, and validate access tokens with configurable lifetimes. It is intended for Symfony APIs and user sessions, not Laravel guards or middleware. Review its underlying JWT library and security model before relying on it.
- Which JWT library and algorithms does ns/token-bundle use?
- The provided metadata does not specify the underlying JWT library or supported signing algorithms. You must verify algorithm support, key formats, and signing and verification behavior before relying on it. JWT handling is security-sensitive, so algorithm confusion and key management require explicit review.
- Does ns/token-bundle support token revocation and refresh tokens?
- The metadata does not confirm revocation, denylists, refresh-token rotation, or key rotation support. JWT validation is generally stateless, but revocation and refresh flows require shared state and clear operational procedures. Validate these concerns with a short architecture spike and security review.
- What Laravel alternatives should I use instead of ns/token-bundle?
- For Laravel APIs, prefer Laravel-native or framework-neutral JWT options such as firebase/php-jwt, lcobucci/jwt, or a maintained Laravel JWT package with guard and middleware integration. These avoid Symfony bundle coupling and fit Laravel's auth architecture. Evaluate maintenance activity, algorithm support, and revocation model before choosing.
- Is ns/token-bundle actively maintained and safe for production?
- The metadata shows 2 stars, 0 dependents, and a 0.01 score, which is minimal ecosystem proof. Maturity, test coverage, supported PHP and Symfony versions, and security posture are not evident. For security-critical auth, expect a high ownership burden and plan to fork or replace it if maintenance lapses.
- What Symfony versions and PHP versions does ns/token-bundle support?
- The provided metadata does not list PHP or Symfony version constraints. You must check the repository's composer.json and release history before adoption. Compatibility with current PHP and Symfony versions is unproven from the context.
- How would I integrate ns/token-bundle with a Laravel API if I had to?
- Use it only behind a narrow Symfony auth or token service boundary, not inside Laravel auth internals. Expose token issue, validation, and revocation through an API and keep Laravel guards and middleware native. Treat the bundle as a reference implementation rather than a drop-in dependency.
- Does ns/token-bundle support asymmetric keys and key rotation?
- The metadata does not document asymmetric key support, key rotation, or algorithm constraints. JWT security depends on explicit signing algorithm and key management review. Confirm these capabilities before using it for API or session tokens.