- Can I install r/u2f-two-factor-bundle in a Laravel application with Composer?
- Not in any practical sense. This repository is a Symfony2 bundle: it ships a Bundle class, a DI extension with compiler passes, services.xml container config, Twig templates, and Doctrine entity wiring, with no Laravel ServiceProvider, config file, migrations, or facades. Composer may resolve the dependency, but nothing in a Laravel bootstrap will register or boot it, so you would be writing a port rather than installing a package.
- Which Laravel and PHP versions does this package support?
- None officially. There is no Laravel support at all, and the Symfony 2.x and 3.4 stack it targets is long past end of life, with PHP constraints that almost certainly predate PHP 8.2 and 8.3. The last release was 2020-05-19, so do not expect a compatibility tag for a current Laravel or PHP runtime.
- What does the bundle actually do?
- It implements the server half of U2F: issuing registration and authentication challenges, verifying attestation and assertion signatures against stored public keys, and enforcing a signature counter to detect cloned tokens. It also provides per-user device management and plugs that verification into scheb/two-factor-bundle as a second-factor provider alongside TOTP and SMS.
- How do I configure and register this bundle?
- In Symfony you register the bundle in AppKernel and let the DI extension load services.xml plus compiler passes, with Doctrine entities storing registered keys and Twig rendering the challenge view. There is no equivalent configuration surface for Laravel's publishable config files or service container, because none of that scaffolding exists in this repository.
- Does this bundle still work in modern browsers?
- No. The navigator.u2f API and the Google Chrome U2F extension were disabled and then removed, with Chrome 98+ in 2022 and other browsers following. The client-side flow this bundle's front end assumes will not execute today, and U2F was superseded by WebAuthn/FIDO2.
- Is r/u2f-two-factor-bundle still maintained?
- Effectively no. It is a single-maintainer project with roughly 11 stars, zero dependents, and a last release in May 2020, and its key dependency scheb/two-factor-bundle is abandoned in favour of scheb/2fa-bundle for Symfony 4.4 and 5+. There is no downstream production validation and no security policy or CVE response process.
- Can I reuse the U2F protocol code instead of installing the bundle?
- Yes, that is the realistic option. The MIT-licensed protocol layer is small and self-contained: challenge generation, origin and RP-ID validation, signature counter monotonicity, and the key storage schema are the parts worth harvesting. Expect a few days to lift and re-home it, and budget time to replace the front end with WebAuthn rather than trying to revive the U2F JavaScript API.
- What should I use instead for hardware-key two-factor authentication in Laravel?
- WebAuthn is the only defensible protocol today; it still supports U2F-era hardware keys as authenticators, but over the CTAP2 and navigator.credentials API. On the PHP side, look at maintained WebAuthn libraries, or Laravel packages that wrap them, rather than a Symfony 2 bundle. Check maintenance status, release cadence, and security disclosure policy before adopting any of them.
- Is it safe to use this package for production two-factor authentication?
- Not recommended. A second-factor verifier is high-value attack surface, and an unmaintained repository offers no patch cadence, no security policy, and no CVE path. Combined with the removed client-side API and the EOL Symfony dependency graph, the safer decision is to build on a maintained WebAuthn implementation.
- How do I test a hardware-key two-factor flow in Laravel?
- There are no test helpers here, and none of the Symfony container or Doctrine wiring transfers to Laravel's testing stack. If you port the protocol code you can unit-test challenge generation, signature verification, and counter checks against fixture attestation and assertion payloads, then fake the second-factor provider boundary in feature tests. Plan for manual verification with a real authenticator before you ship.