Weave Code
Xml Security Laravel Package
simplesamlphp/xml-security
Secure, extensible XML signature and encryption library for PHP (xmldsig/xmlenc). Built on simplesamlphp/xml-common, it helps you sign/verify and encrypt/decrypt XML objects via high-level interfaces, with lower-level APIs available when needed.
SimpleSAMLphp library for XML Security
Frequently asked questions about Xml Security
- Can I use simplesamlphp/xml-security directly in Laravel for SAML authentication?
- No, this package isn’t Laravel-native. For SAML in Laravel, prefer onelogin/php-saml or shibboleth/php-saml. This library is better suited for custom XML workflows (e.g., signing/encrypting SAML responses) where you need low-level control over XML security operations.
- What’s the best way to integrate this package into a Laravel service?
- Wrap the library in a Laravel service class (e.g., `XmlSecurityService`). Inject dependencies like `XMLSecurityDSig` and handle XSD validation via custom logic or Laravel’s `Schema` facade. Example: Validate SAML XML with `$validator->validateXsdTypes($xml, 'saml-schema-provider.xsd')`.
- Does v2.0.0’s strict XSD-type checking break compatibility with older XML?
- No breaking changes are noted, but strict type-checking may reject loosely typed XML. Test your existing payloads to confirm compatibility. If you rely on malformed or non-schema-conforming XML, this could require adjustments to your validation logic.
- How do I handle XSD schema validation in Laravel without built-in XSD tools?
- Store XSD schemas in `storage/app/schemas/` and create a `SchemaValidator` service. Use `DOMDocument::schemaValidate()` for lightweight checks or integrate this library’s `validateXsdTypes()` method. For complex workflows, consider a dedicated XSD library like `rubix/ml`.
- Is simplesamlphp/xml-security secure for production Laravel apps?
- Yes, but with caveats. The library is battle-tested for XML security (xmldsig/xmlenc) and includes strict type-checking in v2.0.0. However, ensure your XSD schemas are trusted (XXE risks) and configure Laravel’s `allow_url_fopen` carefully if loading remote schemas.
- What PHP/Laravel versions does v2.0.0 support?
- Check the package’s `composer.json` for exact PHP requirements (likely 8.0+). For Laravel, ensure your PHP version aligns with your Laravel release (e.g., Laravel 9+ typically requires PHP 8.1+). Test thoroughly if using older Laravel versions.
- Are there performance trade-offs for strict XSD validation?
- Yes, strict type-checking adds overhead. Benchmark against alternatives like `DOMDocument::schemaValidate()` or Extenso/XMLSecurity. For high-throughput apps, consider disabling XSD checks if schemas are optional or caching validation results.
- How do I handle XMLSecurityException errors in Laravel’s exception handler?
- Extend Laravel’s `Handler` to catch `XMLSecurityException` and log/render errors appropriately. Example: `catch (XMLSecurityException $e) { report($e); return response()->json(['error' => 'Invalid XML signature'], 400); }`.
- What alternatives exist for XML security in Laravel?
- For SAML: `onelogin/php-saml` or `shibboleth/php-saml`. For general XML: Extenso/XMLSecurity (pure PHP) or Laravel’s native `DOMDocument`/`SimpleXMLElement`. If you need XSD validation, `rubix/ml` or `ext-dom` with `schemaValidate()` are lighter options.
- How do I sign/verify XML in Laravel using this package?
- Implement `SignableElementInterface`/`SignedElementTrait` in your PHP objects. Example: `$signer = new XMLSecurityDSig(); $signer->sign($xmlObject, $privateKey);`. For encrypted XML, use `XMLSecurityEnc`. The library provides high-level APIs but requires manual setup for Laravel’s DI container.
Weaver
How can I help you explore Laravel packages today?