Weave Code
Paseto Laravel Package
paragonie/paseto
Reference PHP implementation of PASETO security tokens (v3/v4): safer alternative to JWT/JWE/JWS with modern crypto. Supports local and public tokens, includes PASERK integration for key serialization/wrapping, and works with Sodium (or sodium_compat).
Platform-Agnostic Security Tokens
Frequently asked questions about Paseto
- How do I replace JWT in Laravel Sanctum with PASETO?
- Extend Sanctum’s `PersonalAccessToken` model to use PASETO’s `Paseto` class for token creation and validation. Override the `createToken` method to generate v4.local tokens with your encryption key from `config/encryption.php`. Ensure your API middleware checks tokens via a custom guard or by validating the PASETO signature before processing requests.
- Does PASETO work with Laravel Passport for OAuth2?
- Yes, but you’ll need to customize Passport’s `TokenRepository` to issue PASETO tokens instead of JWTs. Replace the `createAccessToken` method to use `Paseto::local()` or `Paseto::public()` with your configured keys. Store tokens in the `oauth_access_tokens` table as strings, and validate them using PASETO’s built-in methods in your auth middleware.
- What Laravel versions support paragonie/paseto?
- PASETO v3/v4 works with Laravel 8.x+ (PHP 8.1+) and Laravel 9.x+. For older Laravel versions (7.x), use PASETO v2, but note it requires PHP 7.1+. Always test in staging first, as some Laravel auth packages may need minor adjustments for token parsing or validation logic.
- How do I handle key rotation for PASETO in Laravel?
- Use PASETO’s `KeyRing` class to manage multiple keys during rotation. Store keys in `config/encryption.php` or a secure secrets manager. During migration, ensure overlapping keys are active to validate tokens signed with either key. For Laravel Sanctum, update the token generation logic to include the new key in the `KeyRing` before issuing tokens.
- Can I use PASETO for session storage in Laravel?
- Yes, PASETO’s v4.local tokens are ideal for encrypted session storage. Store tokens in the database (e.g., `sessions` table) or cache (Redis) as strings. Use `Paseto::local()->decrypt()` to validate and decode tokens when accessing session data. For Laravel’s built-in session driver, extend the `SessionGuard` to handle PASETO tokens.
- What’s the performance impact of PASETO vs. JWT in Laravel?
- PASETO v4 tokens (Sodium-based) are slightly slower than JWTs due to cryptographic overhead, but the difference is negligible for most APIs. Benchmark your specific use case, especially if using `sodium_compat` (adds ~100KB). For high-traffic APIs, cache parsed tokens in Redis to reduce validation latency during requests.
- How do I migrate from JWT to PASETO in a Laravel app?
- Start by replacing token issuance in a single endpoint (e.g., `/api/login`) using feature flags (`config('auth.use_paseto', false)`). Update Sanctum/Passport to dual-write tokens during migration, then gradually phase out JWT support. Use Laravel’s `config('auth.guards.api.driver')` to toggle between JWT and PASETO validation in middleware.
- Are there Laravel-specific validation rules for PASETO tokens?
- Yes, create a custom `PasetoValidator` class extending Laravel’s `Validator` to check token signatures, expiration, and footers. Register it in `AppServiceProvider` and use it in your API routes or form requests. For Sanctum, extend the `HasApiTokens` trait to include PASETO validation logic in the `validatePersonalAccessToken` method.
- Can I use PASETO for API keys or service accounts in Laravel?
- Absolutely. Generate v4.public tokens for stateless API keys (no encryption needed) or v4.local tokens for encrypted service accounts. Store keys in `config/services.php` or a secrets manager. Validate tokens in middleware using `Paseto::public()->verify()` or `Paseto::local()->decrypt()`, then attach the decoded payload to the request for authorization checks.
- What alternatives exist if PASETO isn’t suitable for my Laravel app?
- For JWT alternatives, consider `lcobucci/jwt` (with strict validation) or `firebase/php-jwt` (but avoid due to known vulnerabilities). For encrypted tokens, `defuse/php-encryption` offers AES-256 but lacks PASETO’s modern crypto standards. If you need compliance with existing systems, stick with JWT but enforce short-lived tokens and use PASETO only for new projects.
Weaver
How can I help you explore Laravel packages today?