Weave Code
Security Token Extractor Laravel Package
smartassert/security-token-extractor
Extract security tokens from incoming HTTP requests through one consistent API. This small PHP package keeps token parsing out of your controllers and middleware, so Laravel and other PHP applications can authenticate cleanly with less duplicated logic, clearer code, and easier testing.
A small, framework-agnostic PHP library for extracting security tokens from HTTP requests. It offers a clear, composable way to retrieve tokens from common request locations—such as the Authorization header, custom headers, query parameters, or cookies—while returning null when no token is present.
- Composable extractors for common token sources
- Framework-agnostic design for easy integration
- Predictable, null-safe behavior when tokens are missing
- Simple API for authentication and authorization flows
- Lightweight and focused on a single responsibility
Frequently asked questions about Security Token Extractor
- How do I install smartassert/security-token-extractor in Laravel?
- Install it with composer require smartassert/security-token-extractor. Laravel's package auto-discovery should register the package service provider; if your app does not use auto-discovery, register it manually as shown in the repository documentation. Then configure the extractors your application needs.
- What token sources and credential types can it extract?
- It can extract bearer tokens, API keys, and custom credential values from HTTP headers, query parameters, cookies, and request bodies. The exact supported combinations depend on the extractors you configure. This lets you support different clients without scattering request-parsing logic across controllers.
- How do I extract a Bearer token from the Authorization header?
- Configure a header extractor for the Authorization header and set it to recognize the Bearer scheme. The extractor returns the token value without the Bearer prefix, so your app can pass it to authentication or validation logic. Keep the extractor configuration centralized rather than reading the header manually in each controller.
- Can I extract API keys from query parameters, cookies, or request bodies?
- Yes. The package is designed for configurable extraction from headers, query parameters, cookies, and request bodies, so API keys can be read from any of those sources when the corresponding extractor is configured. Use query or cookie extraction only when your security model accepts the associated risks. Prefer headers for production APIs where possible.
- How do I configure multiple extractors and control which one is used first?
- Configure one extractor per source or credential format, then use the package configuration to define the order in which they are attempted. This is useful for supporting both modern Bearer tokens and legacy API keys during a migration. Make sure the first successful match is the credential you actually intend to trust.
- Can I write a custom extractor for a non-standard token format?
- Yes. Because extraction is handled by configurable extractors, you can add a custom extractor for a non-standard header or credential format. Register or reference it through the package configuration as described in the documentation. That keeps custom parsing testable and reusable across requests.
- Which Laravel and PHP versions are supported, and is the package maintained?
- The provided context does not list specific Laravel or PHP version constraints. Check the package composer.json, README, and release history on GitHub for the exact supported versions and maintenance status before installing or upgrading. That is especially important if you are on the newest Laravel release or an older PHP runtime.
- How do I test security token extraction in a Laravel feature test?
- Use Laravel HTTP tests to send requests with the token in each source you support, such as an Authorization header, query string, cookie, or JSON body. Assert that your application receives the expected token and rejects malformed or missing credentials. Test each configured extractor rather than only the default path.
- Is this package suitable for production, and does it validate tokens?
- The package extracts tokens; it does not replace your authentication, authorization, or token validation layer. Use HTTPS, avoid logging raw tokens, validate credentials server-side, and rotate or revoke them when needed. Treat query-string and cookie extraction as higher-risk options and secure them accordingly.
- How is this different from Laravel's request()->bearerToken() or manually reading headers?
- Laravel's request()->bearerToken() is convenient for a single Authorization Bearer header, while this package adds configurable extraction across headers, query parameters, cookies, and bodies. If you only need one standard header, the built-in method may be enough. If you support multiple client credential styles, a dedicated extractor package can reduce duplicated parsing code.
Weaver
How can I help you explore Laravel packages today?