- Is siganushka/request-token-bundle a Laravel package or a Symfony bundle?
- It is published as a Symfony bundle, not a Laravel package. The overview describes Symfony form and HTTP kernel integration plus service- and attribute-based token generation. Laravel applications can only use it if their transitive Symfony components satisfy the bundle's constraints, so confirm that path before adding it to a Laravel composer.json.
- What PHP and Symfony versions does request-token-bundle v1.2.0 require?
- The only documented change in v1.2.0 is a raised platform floor: PHP 8.2 or newer and Symfony 7.4 or newer. No other code, feature, or behavioral changes are described in the available release information. Treat it as a platform-requirement release and verify the exact constraints in the package's own composer.json.
- How do I install siganushka/request-token-bundle with Composer?
- Install it with composer require siganushka/request-token-bundle, but first run composer why-not symfony/* 7.4 and confirm your runtime is PHP 8.2 or newer. In Laravel projects installation can fail during dependency resolution if illuminate packages still pin Symfony 6.x components. Pin an explicit package version rather than a floating constraint so automated updates cannot shift the platform floor unexpectedly.
- Can I use request-token-bundle in a Laravel application?
- Only if your Laravel version's transitive Symfony constraints allow Symfony 7.4 and your runtime is PHP 8.2 or newer. Laravel releases that pin Symfony 6.x will block resolution and fail early at Composer time. There is no documented Laravel service provider, config publishing, or facade in the available material, so any Laravel wiring would be custom code you own.
- How do request tokens prevent duplicate form submissions and replay attacks?
- Each request carries a unique token that is validated and consumed exactly once, so a replayed payload or resubmitted form fails validation. Storage is pluggable, so token state can live in whatever store fits your infrastructure. This stops accidental double writes and simple replay attempts without adding heavy infrastructure.
- How do I generate and validate a request token in my application?
- The overview describes generating and validating tokens through simple services or attributes, backed by framework-agnostic token logic. Exact class names and method signatures are not included in the available excerpt, so check the repository README and source for service IDs and attribute names. Write a small integration test that issues a token, consumes it, and asserts that the second use is rejected.
- Does the bundle support one-time token consumption with custom storage?
- Yes, one-time consumption with pluggable storage is a headline feature in the package overview. Custom storage means you control where token state lives, such as a cache, database table, or Redis. Verify the storage contract in the repository before assuming a driver already exists for your stack.
- Is v1.2.0 a breaking change, and is there a v1.1.x line for PHP 8.1 or Symfony 6?
- The version number is a minor bump, but raising the floor to PHP 8.2 and Symfony 7.4 is a breaking platform change for consumers on older runtimes. The available information does not confirm a supported v1.1.x maintenance line or its security policy. Pin the previous release and ask the maintainer about maintenance commitments before relying on it long term.
- How should I test request-token integration in CI and staging?
- Start with composer update --dry-run in a branch to surface dependency conflicts, then run your full test suite plus a package-specific test that consumes the same token twice. Check base images, CI PHP versions, and Symfony component pins, since those are the most common failure points after a platform floor bump. Validate on staging or a canary deployment before rolling out to production.
- What are alternatives for request tokens and duplicate submission protection in Laravel?
- Laravel ships CSRF tokens and session-based form protection, but those are not one-time request tokens. You can add idempotency keys, database unique constraints, or a small cache-backed token service to get the same one-time semantics without a Symfony bundle. Choose based on whether you need framework-level form integration or just replay protection at the API boundary.