Weave Code
Oauth2 Server Defuse Generator Bundle Laravel Package
spomky-labs/oauth2-server-defuse-generator-bundle
A Symfony bundle that integrates Defuse encryption primitives with the OAuth2 Server, providing key generation and cryptographic support for securing OAuth2 tokens and credentials.
Symfony2 Defuse Generator for OAuth2 Server Bundle
Frequently asked questions about Oauth2 Server Defuse Generator Bundle
- What does spomky-labs/oauth2-server-defuse-generator-bundle actually do?
- It is a thin Symfony 2 dependency-injection bundle that registers a key-generator service for the sibling spomky-labs/oauth2-server-bundle, backed by defuse/php-encryption. The functional surface is only a few dozen lines of service wiring plus a small adapter class. It does not implement OAuth 2.0 itself; it is a convenience registration for one crypto library choice.
- Can I use spomky-labs/oauth2-server-defuse-generator-bundle in a Laravel application?
- No, not directly. The package assumes Symfony full-stack idioms such as AppKernel registration, a DependencyInjection Extension class, XML or YAML service definitions, and compiler passes with service tags. It ships no ServiceProvider, no publishable config, and no package auto-discovery, so Laravel cannot load it as a normal Composer package.
- Is it compatible with Laravel 10 or 11 and PHP 8.2?
- No. The bundle targets PHP 5.5 through 7.x and symfony/symfony roughly 2.3 to 2.8, while Laravel 10 and 11 run on PHP 8.1+ with Symfony 6 or 7 components. Composer will either refuse to resolve the dependency set outright or resolve it by pinning your framework downward. That is a platform-wide downgrade, not a single-package install.
- Does this bundle implement an OAuth 2.0 authorization server?
- No. It only supplies a key generator that satisfies an extension point inside spomky-labs/oauth2-server-bundle, which is a separate package. If your actual problem is building an authorization server, this bundle addresses none of that; it only handles the token and credential encryption side, and only in a Symfony 2 context.
- Is spomky-labs/oauth2-server-defuse-generator-bundle still maintained?
- Effectively no. The upstream OAuth2 Server Bundle line was superseded by web-token/jwt-framework, and this companion bundle is a dead branch of that tree. It has zero stars and zero dependents, meaning no external security review, no issue triage, and no one else hitting a breakage before you do. The underlying defuse/php-encryption library is also in maintenance-only or abandoned status.
- What should I use instead of this bundle for OAuth2 token encryption in Laravel?
- Use laravel/passport, which handles key generation via the passport:keys command, or Illuminate\Encryption\Encrypter with AES-256-GCM for encrypting values at rest. For lower-level needs, random_bytes() and sodium_crypto_secretbox or sodium_compat are the current ecosystem primitives. These are maintained, audited by a large user base, and integrate natively with Laravel.
- Can I extract the adapter class from this bundle and hand-port it into Laravel?
- Technically yes, but it is economically pointless. You would own the extracted code and the defuse/php-encryption dependency chain with no upstream support. The behavior it provides, generating a key from a CSPRNG and passing it to the token layer, is reproducible with random_bytes() or sodium, so extraction costs more than reimplementation.
- What Symfony and PHP versions does this bundle require?
- It targets PHP 5.5 through 7.x and symfony/symfony approximately 2.3 to 2.8. Symfony 2.x has been end-of-life since 2018, and its bundle conventions predate Symfony 4's autowiring. There is no version overlap with a modern Laravel stack on Symfony 6 or 7 components.
- Is defuse/php-encryption still safe to use for OAuth token encryption?
- defuse/php-encryption is in maintenance-only or abandoned status, and the wider ecosystem has moved to libsodium and sodium_compat. OAuth token generation and encryption sit on the authentication critical path, so an unmaintained crypto dependency is a high, asymmetric risk. A compliance driver such as PCI-DSS or SOC 2 would almost certainly forbid it.
- What happens if I run composer require for this package in a Laravel project?
- Composer will either fail dependency resolution or satisfy it by downgrading symfony/* and your PHP constraint, which effectively rolls the platform back several years. You get no Laravel service provider, so even a successful install would not wire anything up. Treat the repository as a reference implementation rather than a dependency.
Weaver
How can I help you explore Laravel packages today?