Weave Code
Refresh Token Manager Bundle Laravel Package
praetoriantechnology/refresh-token-manager-bundle
A Symfony bundle for managing refresh tokens securely, with services and configuration for issuing, rotating, validating, and revoking tokens, plus storage integration for authentication workflows.
At a glance
Frequently asked questions about Refresh Token Manager Bundle
- Is this a Laravel package or a Symfony bundle, and can I use it in a Laravel app?
- The composer name and the -bundle suffix indicate this is a Symfony bundle, not a Laravel-native package. Laravel will not auto-discover a Symfony bundle the way it discovers a service provider, so you would need a hand-rolled adapter or wrapper around its services. Treat it as a reference implementation to wrap rather than a dependency to drop in unless the maintainers explicitly ship Laravel support.
- How do I install and configure the refresh token manager bundle?
- Installation is a standard composer require followed by publishing the bundle configuration and registering the guard or middleware in your auth flow. The mechanical steps are quick; the real effort is verifying that the rotation and revocation semantics match your security requirements. Budget roughly one to two days for integration and several more for security and edge-case validation.
- Which PHP and Laravel versions does this package support?
- The repository is a Symfony bundle, so its declared version matrix will target Symfony framework releases and a PHP floor rather than Laravel releases. Check the composer.json constraints directly and compare them against your target PHP version and Laravel version before committing. Because the metadata shows no dependents or community usage, do not assume it has been tested against current Laravel releases.
- What storage backends are supported, and are refresh tokens hashed at rest?
- The overview mentions storage integration for authentication workflows but does not specify which backends are supported, so confirm this in the source before adopting. More importantly, verify that tokens are hashed at rest rather than stored in plaintext, since a database leak with plaintext refresh tokens is equivalent to a full credential compromise. Also check whether the rotation logic relies on transactions or unique constraints, and test against your actual database engine rather than SQLite in CI.
- Does it implement refresh token rotation with reuse detection?
- Rotation is listed as a core capability, but the critical question is whether a rotated token is invalidated and whether reusing an already-rotated token triggers revocation of the entire token family. Replay detection of that kind is the single most common flaw in home-grown refresh implementations. Verify it explicitly in the code or test suite, because the absence of it silently weakens the whole scheme.
- Can I use this bundle alongside Laravel Sanctum or Passport?
- That depends on how much of the auth flow the bundle expects to own, which the available overview does not make clear. If it assumes control of issuance, storage, and validation end to end, layering it on top of Sanctum or Passport will create two competing sources of truth for tokens. Confirm before you build whether it can act purely as a token rotator behind your existing guard.
- Is this package safe to use in production given its adoption signals?
- The metadata shows zero stars, zero score, and zero dependents, which means there is no evidence of production use or external bug discovery. For a component that mints and invalidates credentials, that is a material risk rather than a cosmetic one. If you adopt it, scope it behind an internal interface so you can replace it without rewriting your auth feature.
- How does it behave when two requests refresh the same token at the same time?
- Concurrent refresh is a classic race in rotation schemes: two simultaneous requests can both present the same token, and the outcome depends on locking or unique constraints in the token store. Check whether the implementation serializes rotation or treats the second request as replay and revokes the family. Test this against your real database engine, since behavior under SQLite in CI often differs from production.
- What is the license, and can I fork it if it gets abandoned?
- The license is not stated in the provided overview, so read the LICENSE file in the repository before adopting. An unmaintained auth dependency is one abandoned commit away from a fork obligation, so confirm the license permits an internal fork and modification. Also identify the maintainer and whether there is a security disclosure channel.
- Should I use this package or write my own refresh token manager?
- Given the Symfony-to-Laravel mismatch and the lack of adoption signals, the pragmatic path is to define your own TokenIssuer and TokenRotator interfaces and treat this bundle as one possible implementation behind them. That caps your switching cost at a single class if the package is abandoned and lets you ship the auth feature without betting the roadmap on an unvetted dependency. Retrofit only new token-issuing flows, and leave existing token formats valid until they expire naturally.
Weaver
How can I help you explore Laravel packages today?