- How do I install and configure rcerljenko/laravel-jwt in a Laravel app?
- The expected path is to run composer require, publish the package config, register the guard in config/auth.php, and add the middleware to the route groups you want to protect. You then point your login flow at the package's token issuance helper and return the JWT to the client. The install itself is low-to-moderate effort, but confirm the composer.json Laravel version constraints and test coverage before committing. Real effort sits in security review and front-end coordination, especially if you enable the 2.1.0 cookie transport.
- What is rcerljenko/laravel-jwt used for?
- It is a lightweight JWT authentication layer for Laravel that provides a guard, middleware, and token helpers for issuing, validating, and refreshing JSON Web Tokens. It fits stateless API authentication where you want self-contained JWT claims without adopting Passport's OAuth2 surface area. It is also suitable for first-party SPAs or server-rendered front ends that terminate auth at the same Laravel app. It is a poor fit for third-party clients, scopes or consent, refresh-token grant semantics, or delegated authorization.
- Does rcerljenko/laravel-jwt support Laravel 10 or Laravel 11?
- The provided evaluation context does not state specific Laravel version support, so do not assume compatibility from the package description alone. Check the composer.json require constraints and the package test matrix before committing. This is the first formal assessment with no prior baseline, so conclusions are directional and should be confirmed against the source. If your app is on Laravel 10 or 11, verify the dependency constraints explicitly in your own environment.
- How does the 2.1.0 cookie token support in laravel-jwt work?
- The 2.1.0 release note says it added support for token via cookie, contributed in PR #2 by @ashraful1971. The context describes this as a config-level addition rather than an API change, so it should be adoptable incrementally for existing header-based users. However, the release note does not state whether the cookie is HttpOnly, Secure, or SameSite configurable, whether Laravel's cookie middleware encrypts or signs it, or how header-versus-cookie precedence is resolved. Treat it as a security-relevant feature and read the source and diff before enabling it.
- Is cookie-based JWT auth in laravel-jwt safe from CSRF attacks?
- The provided release note does not confirm whether CSRF safeguards ship with the cookie feature, so this must be verified in source rather than assumed. A token carried in a cookie is sent automatically by the browser, so if the package reads the cookie for state-changing requests, CSRF protection becomes mandatory. That means using SameSite plus Laravel's CSRF middleware or an equivalent double-submit or header check. If the package does not ship this, CSRF protection is entirely the integrator's responsibility.
- What is the precedence between the Authorization header and cookie in laravel-jwt?
- With two transports, the resolution order between the Authorization header and the cookie becomes a behavioral contract, and the provided context does not specify it. Ambiguity here produces hard-to-diagnose 401s and, worse, silent auth fallbacks. Check the package source to see whether precedence is configurable or can be disabled per guard. Test both transports explicitly in your application before relying on cookie auth in production.
- Can I use rcerljenko/laravel-jwt for a cross-origin SPA?
- Cross-origin SPAs require credentialed requests with credentials include and a non-wildcard Access-Control-Allow-Origin header. Misconfiguration yields cookie rejection that looks like a token bug, so review CORS settings carefully if you enable cookie transport. For a first-party SPA that needs cookie-based sessions, evaluate Laravel Sanctum first because it solves the same problem with first-party maintenance and built-in CSRF and stateful-domain handling. Header-based JWT usage with laravel-jwt is more straightforward for cross-origin scenarios.
- How do I test JWT authentication with laravel-jwt?
- The provided context does not describe the package's own test coverage, so confirm that before commitment. In your application, issue a token through the package helper, call protected routes with and without the Authorization header, and assert 401 versus success responses. If cookie transport is enabled, also test cookie-based requests, header-versus-cookie precedence, expiry and refresh behavior, and CSRF handling for state-changing routes. Laravel's HTTP testing helpers make these assertions straightforward, but the security cases need explicit coverage.
- What are the alternatives to rcerljenko/laravel-jwt?
- Laravel Sanctum is the usual alternative for first-party SPA and API token authentication, with built-in CSRF and stateful-domain handling and first-party maintenance. Laravel Passport fits when you need OAuth2 scopes, consent, refresh-token grant semantics, or delegated authorization. A standard JWT library is enough if you only need token encoding and decoding without a Laravel guard and middleware layer. laravel-jwt is low lock-in and replaceable because it uses standard JWT, but it has no vendor SLA.
- Is rcerljenko/laravel-jwt actively maintained and production-ready?
- The assessment describes a single-maintainer, low-cadence package with a very small contributor base, including one external contributor on the 2.1.0 cookie PR. There is no vendor SLA, and a small PR-numbered feature shipping in a minor version means the changelog is thin relative to its security significance. For auth packages, consumers should read the diffs rather than relying on release notes. Adoption of header-based usage is reasonable now, but treat cookie transport as opt-in and gate it behind a security review.