Weave Code
Cose Lib Laravel Package
web-auth/cose-lib
PHP 8.1+ COSE (RFC 9052/9053) library for CBOR Object Signing and Encryption. Supports COSE_Sign1/Sign, Encrypt0/Encrypt, Mac0/Mac tags plus ECDSA, EdDSA, RSA/PS and HMAC algorithms; useful for WebAuthn/FIDO2 and certificates.
Cose Key and Algorithms support
Frequently asked questions about Cose Lib
- How do I integrate this COSE library into a Laravel application for WebAuthn/FIDO2 authentication?
- Start by installing the package via Composer and registering it as a Laravel service provider. Use the `CoseSign1` class to verify WebAuthn attestation signatures, then bind the COSE library to Laravel’s container for easy dependency injection. The library’s strict typing ensures compatibility with Laravel’s modern PHP 8.1+ ecosystem. For key management, integrate with Laravel Vault or AWS KMS to securely store private keys.
- Which Laravel versions are officially supported by this COSE library?
- The library is designed for PHP 8.1+ and works seamlessly with Laravel 9.x and 10.x. Since Laravel 11 drops PHP 8.0 support, this package aligns perfectly with modern Laravel versions. Always test with your specific Laravel version to ensure compatibility, especially if using custom middleware or service providers.
- Can I use this package to replace JWT in my Laravel API for better security?
- Yes, this library supports COSE_Sign1 (RFC 9052) for digital signatures, which can replace JWT for API authentication. COSE offers better structure for complex payloads and integrates natively with WebAuthn/FIDO2. However, benchmark performance against JWT, as COSE may introduce slight overhead due to CBOR encoding. Use Laravel middleware to validate COSE signatures in API routes.
- How do I handle key rotation for COSE signatures in a Laravel application?
- Store keys in Laravel’s cache or database (e.g., using `kid` headers for key identification). Automate rotation via Laravel’s scheduler by invalidating cached keys and updating the database. For high-security environments, integrate with AWS KMS or HashiCorp Vault. Always test key transitions in a staging environment before production deployment.
- Does this library support asymmetric encryption (e.g., COSE_Encrypt) for secure API-to-API communication?
- Yes, the library fully supports COSE_Encrypt (tag 96) and COSE_Encrypt0 (tag 16) for asymmetric encryption using RSA, ECDH, or EdDSA algorithms. This is ideal for secure API communication in Laravel applications. Configure encryption keys in Laravel’s config or environment files, and use the library’s `CoseEncrypt` class to encrypt/decrypt payloads in middleware or services.
- How do I verify a COSE signature in a Laravel HTTP request (e.g., API gateway)?
- Create a custom Laravel middleware to decode and verify COSE_Sign1 signatures. Use the `CoseSign1Tag` and `Signature1` classes to parse the CBOR payload, then validate the signature against the public key. Store public keys in Redis or the database for performance, and cache them with a TTL to handle key rotation. Example: `php artisan make:middleware VerifyCoseSignature`.
- Are there performance concerns when using COSE for high-throughput Laravel APIs?
- COSE operations are optimized for PHP 8.1+, but cryptographic workloads can be CPU-intensive. Benchmark against JWT using tools like Blackfire or Laravel Benchmark. For high-throughput APIs, offload COSE operations to Laravel queues or use asynchronous processing. Cache public keys in Redis to reduce verification latency.
- Can I extend this library to support custom cryptographic algorithms or CBOR decoders?
- Yes, the library is designed for extensibility. You can register custom CBOR decoders or algorithm extensions by leveraging its modular architecture. For example, override the `TagManager` to add support for proprietary algorithms. The README provides examples for integrating with `spomky-labs/cbor-php`, which can be extended further for niche use cases.
- How do I store COSE payloads in a Laravel database (e.g., PostgreSQL or MySQL)?
- Store COSE payloads as JSONB in PostgreSQL or BLOB fields in MySQL for flexibility. Use Laravel accessors/mutators to decode COSE objects on retrieval. For example, add a `getCosePayloadAttribute` method to your Eloquent model to automatically decode the CBOR data when accessing the attribute. This approach keeps your database schema simple while enabling rich querying.
- What alternatives exist for COSE in Laravel, and when should I choose this library?
- Alternatives include custom implementations of RFC 9052/9053 or libraries like `libcose` (C/C++ bindings). Choose this library for its PHP-native implementation, Laravel integration, and support for WebAuthn/FIDO2. If you need FIPS 140-2 compliance, validate EdDSA/Ed25519 support with your security team, as some environments require additional validation. This package is ideal for developers prioritizing RFC compliance and modern PHP features.
Weaver
How can I help you explore Laravel packages today?