Weave Code
Security Bundle Laravel Package
rezzza/security-bundle
RezzzaSecurityBundle is a Symfony bundle that packages reusable security utilities and integration for authentication and authorization, helping developers add access control and security-related services to Symfony applications.
Signed requests check
Frequently asked questions about Security Bundle
- Can I install rezzza/security-bundle in a Laravel app with Composer?
- No. rezzza/security-bundle is a Symfony bundle: it ships a dependency injection extension, a compiler pass, and a SecurityListener bound to Symfony's kernel event lifecycle, with no service provider, facade, or Laravel package discovery manifest. Composer can pull the code in, but nothing in a Laravel HTTP kernel will register or execute it, so you get zero working behavior without writing an adapter. For Laravel, plan to reimplement the small feature set instead.
- What does rezzza/security-bundle actually do?
- It provides two narrow things: an HMAC-style signature validation listener that inspects inbound requests during the kernel event cycle, and a profiler data collector decorator that masks request payloads and parameters so they do not leak into Symfony's profiler request panel. The rest is glue code: a DI extension and a compiler pass wiring those services together. Both concerns are small and well understood, which is why porting them is realistic.
- Which Symfony and PHP versions does rezzza/security-bundle support?
- The last release is dated 2017-09-06, so its Composer constraints almost certainly pin symfony/* to ^2.x or ^3.x. Its listener signatures rely on event classes that were later renamed or deprecated, notably GetResponseEvent becoming RequestEvent, so it will not run cleanly on Symfony 5, 6, or 7 without code changes. Treat it as unsupported on modern PHP 8 runtimes until you personally verify every transitive dependency.
- Is rezzza/security-bundle still maintained?
- No. There has been no commit since September 2017, and the repository shows roughly 16 stars and zero dependents, meaning no community has stress-tested it against a current runtime. For a package whose entire purpose is request authentication, nine years without security patches is a genuine risk. Treat it as reference source code rather than a dependency you adopt.
- What Laravel features replace the HMAC signature check in rezzza/security-bundle?
- Laravel ships ValidateSignature middleware for signed URLs and requests, EncryptCookies for encrypted cookie payloads, and hash_equals for constant-time comparison inside your own middleware. A custom middleware of roughly 100 lines can handle HMAC verification, canonicalization of the payload, and timestamp or nonce checks for replay protection. That path is native to Laravel's HTTP kernel, testable with phpunit, and fully owned by your team.
- How do I replicate the profiler payload masking in Laravel?
- You do not need a bundle for this: the Symfony profiler is a dev-only tool, and Laravel's equivalent is Telescope plus your logging configuration. Use Telescope's sensitive-data redaction or a logging processor to strip parameters and headers before they are recorded. If masking is a compliance requirement, implement it as a central logging redaction control rather than a framework-specific decorator, because silent changes to debug output can mislead incident responders.
- Is rezzza/security-bundle safe to use for production authentication?
- Not without an audit. The signature check was never maintained through the modern security hardening era, so you would have to verify constant-time comparison, the payload canonicalization rules, and whether replay attacks are defended against. Because the last release predates Symfony 5, 6, and 7, there are also no patches for framework-level issues. You cannot inherit that assurance by adoption; reading and reimplementing the roughly 200 lines is the safer route.
- Does rezzza/security-bundle have tests or a CI matrix I can rely on?
- There is no published test matrix you can rely on, and no active maintainer to confirm whether edge cases are covered. With zero dependents, the package has not been exercised across PHP versions, Symfony versions, or real traffic patterns. If you fork it, budget for writing your own tests covering signature mismatch, malformed payloads, replay, and encoding differences.
- Should I fork rezzza/security-bundle or reimplement it?
- Reimplement rather than fork. The functional surface is small, the code is old, and a fork leaves you owning Symfony-bound code you still have to carry through future framework upgrades. Porting the behavior into a Laravel middleware, or into a current Symfony listener if your stack is Symfony, gives you a testable, documented component that fits your application. Keep the original only as a reference.
- What are the alternatives to rezzza/security-bundle?
- On Symfony, use the framework's own Security component and symfony/security-bundle, plus maintained packages such as lexik/jwt-authentication-bundle for token auth. On Laravel, use signed URLs, the ValidateSignature middleware, and a small custom HMAC middleware. Either way, choose a package with recent releases and a supported framework version range instead of an abandoned bundle.
Weaver
How can I help you explore Laravel packages today?