Weaver

Helps Laravel developers discover, compare, and choose open-source packages. See popularity, security, maintainers, and scores at a glance to make better decisions.

Jwt Framework Laravel Package

web-token/jwt-framework

A comprehensive PHP library for JSON Web Tokens, implementing JWS, JWE, JWK, JWT, and related RFCs. It offers signing, encryption, key management, and token validation with a clean, standards-compliant API suitable for any PHP project.

View on GitHub

Deep Wiki

Context7

4.2.3

Release Notes for 4.2.3

4.2.x bugfix release (patch)

4.2.3

Total issues resolved: 0
Total pull requests resolved: 2
Total contributors: 1

Dependencies

730: fix(composer): allow brick/math 1.0 thanks to @Spomky

bug

722: ci: check out the repository properly in the gitsplit workflow thanks to @Spomky

4.1.7

Release Notes for 4.1.7

Security patch release (4.1.x).

Brings the security fixes up from 4.0.x (#655):

PBES2-HS*+A*KW — bounded p2c (PBKDF2 iteration count) to prevent a CPU-amplification denial of service. (GHSA-3prj-6hqw-cm82)
ChaCha20-Poly1305 key encryption — Poly1305 authentication tag now emitted and verified. (GHSA-6vvh-pxr4-25r7)
RSA1_5 — constant-time implicit rejection (Bleichenbacher mitigation). (GHSA-5739-39v2-5754)
JWS — alg read only from the integrity-protected header (algorithm-confusion mitigation). (GHSA-jc38-x7x8-2xc8)

4.0.7

Release Notes for 4.0.7

Security patch release (4.0.x).

Brings the security fixes up from 3.4.x (#652):

PBES2-HS*+A*KW — bounded p2c (PBKDF2 iteration count) to prevent a CPU-amplification denial of service. (GHSA-3prj-6hqw-cm82)
ChaCha20-Poly1305 key encryption — Poly1305 authentication tag now emitted and verified. (GHSA-6vvh-pxr4-25r7)
RSA1_5 — constant-time implicit rejection (Bleichenbacher mitigation). (GHSA-5739-39v2-5754)
JWS — alg read only from the integrity-protected header (algorithm-confusion mitigation). (GHSA-jc38-x7x8-2xc8)

Also included:

#641 Enhance key operations validation in UsageAnalyzer and add unit tests thanks to @Spomky

3.4.10

Release Notes for 3.4.10

Security patch release.

This release addresses four security issues in the JOSE implementation:

PBES2-HS*+A*KW — the p2c (PBKDF2 iteration count) is now bounded (configurable) to prevent a CPU-amplification denial of service. (GHSA-3prj-6hqw-cm82)
ChaCha20-Poly1305 key encryption — the Poly1305 authentication tag is now emitted and verified; tampered tokens are rejected. (GHSA-6vvh-pxr4-25r7)
RSA1_5 — PKCS#1 v1.5 decryption now uses constant-time implicit rejection, mitigating Bleichenbacher-style padding oracles. (GHSA-5739-39v2-5754)
JWS — the alg parameter is read only from the integrity-protected header, preventing algorithm-confusion attacks. (GHSA-jc38-x7x8-2xc8)

Note: 3.4.10 ships the fixes; the accompanying test-suite update is included in 3.4.11.

4.1.6

Release Notes for 4.1.6

4.1.x bugfix release (patch)

Fix brick/math version in the library

4.1.6

Total issues resolved: 1
Total pull requests resolved: 0
Total contributors: 0

4.1.5

Release Notes for 4.1.5

4.1.x bugfix release (patch)

4.1.5

Total issues resolved: 0
Total pull requests resolved: 0
Total contributors: 0

4.1.4

Release Notes for 4.1.4

4.1.x bugfix release (patch)

4.1.4

Total issues resolved: 0
Total pull requests resolved: 1
Total contributors: 1

Dependencies

649: Update brick/math constraint and remove dev minimum stability thanks to @Spomky

4.1.3

Release Notes for 4.1.3

4.1.x bugfix release (patch)

4.1.3

Total issues resolved: 0
Total pull requests resolved: 1
Total contributors: 1
648: Fix PHP 8.5 deprecation thanks to @sandesh-as

4.1.2

Release Notes for 4.1.2

4.1.x bugfix release (patch)

4.1.2

Total issues resolved: 0
Total pull requests resolved: 0
Total contributors: 0

4.1.1

Release Notes for 4.1.1

4.1.x bugfix release (patch)

4.1.1

Total issues resolved: 1
Total pull requests resolved: 2
Total contributors: 2

bug

645: Refactor command help text definitions for Symfony Console compatibility thanks to @Spomky and @LumiSys
643: Update CI configuration to trigger on all version branches thanks to @Spomky

3.4.9

Release Notes for 3.4.9

3.4.x bugfix release (patch)

3.4.9

Total issues resolved: 0
Total pull requests resolved: 1
Total contributors: 1

enhancement

644: Add sodium support for Base64 URL safe encoding/decoding thanks to @jdreesen

4.1.0

What's Changed

Feature release (minor). For users upgrading from v4.0, see the Migration Guide from v4.0 to v4.1.

New Features & Improvements

Symfony 8.0 support (#628)
Sodium-based Base64URL encoding: improved performance when ext-sodium is installed (#636)
brick/math 0.14 support (#634)

Deprecations

UrlKeySetFactory::enabledCache() is deprecated. Use the cache constructor parameter instead (#618)

Other Changes

Refactored getAAD() return type from nullable to non-nullable string (#638)
New CI/CD workflow (#629)

Contributors

Thanks to @Spomky, @stof, @tscni, and @nrolando.

4.0.6

Release Notes for 4.0.6

4.0.x bugfix release (patch)

4.0.6

Total issues resolved: 0
Total pull requests resolved: 1
Total contributors: 1
632: Fix key derivation by removing curve size parameter from openssl_pkey_derive thanks to @Spomky

4.0.5

Release Notes for 4.0.5

4.0.x bugfix release (patch)

4.0.5

Total issues resolved: 1
Total pull requests resolved: 3
Total contributors: 3

bug

630: Add 'private_key_bits' option to EC key generation thanks to @Spomky
617: Refactor constructors and update dependencies. thanks to @Spomky

Dependencies,wontfix

616: Useless ext-json requirement thanks to @garak
612: Use correct base class for JoseFrameworkExtension thanks to @fritz-gerneth

3.4.8

Release Notes for 3.4.8

3.4.x bugfix release (patch)

3.4.8

Total issues resolved: 0
Total pull requests resolved: 1
Total contributors: 1

Dependencies

620: Allow psr/cache v2 thanks to @jdreesen

4.0.4

Release Notes for 4.0.4

4.0.x bugfix release (patch)

4.0.4

Total issues resolved: 0
Total pull requests resolved: 1
Total contributors: 1

Dependencies

608: Add support for brick/math 0.13 thanks to @stof

4.0.3

Release Notes for 4.0.3

4.0.x bugfix release (patch)

4.0.3

Total issues resolved: 1
Total pull requests resolved: 1
Total contributors: 2

CI-CD

604: Update phpstan-baseline and GitHub workflow dependencies thanks to @Spomky

DX,bug

601: Broken/incomplete config key deprecation thanks to @MIvanIsten

4.0.2

Release Notes for 4.0.2

4.0.x bugfix release (patch)

4.0.2

Total issues resolved: 0
Total pull requests resolved: 1
Total contributors: 1

bug

599: Add new targets, update dependencies, and support PHP 8.4 thanks to @Spomky

3.4.7

Release Notes for 3.4.7

3.4.x bugfix release (patch)

3.4.7

Total issues resolved: 0
Total pull requests resolved: 1
Total contributors: 1

bug

596: Fix call function on null thanks to @PeterMead

4.0.1

Release Notes for 4.0.1

4.0.x bugfix release (patch)

4.0.1

Total issues resolved: 0
Total pull requests resolved: 1
Total contributors: 1

DX

578: Allow PHP 8.2 and remove mb_ calls thanks to @Spomky

3.4.6

Release Notes for 3.4.6

3.4.x bugfix release (patch)

3.4.6

Total issues resolved: 0
Total pull requests resolved: 1
Total contributors: 1

bug

577: Add RangeException to Base64UrlSafe thanks to @Spomky

3.4.5

Release Notes for 3.4.5

3.4.x bugfix release (patch)

3.4.5

Total issues resolved: 0
Total pull requests resolved: 1
Total contributors: 1

bug

576: Add Base64UrlSafe utility and refactor code references thanks to @Spomky

4.0.0

What's Changed

This is a major release with breaking changes. Please read the Migration Guide from v3.x to v4.0 before upgrading.

Breaking Changes

PHP 8.2+ required
PSR-20 Clock is now mandatory: ExpirationTimeChecker, IssuedAtChecker, and NotBeforeChecker now require a ClockInterface as the first constructor argument (previously optional and last). The internal InternalClock class has been removed.
Simplified JWE constructors: JWEBuilder and JWEDecrypter now accept a single AlgorithmManager instead of separate key encryption, content encryption, and compression managers. The same applies to JWEBuilderFactory and JWEDecrypterFactory.
Compression support removed: All compression classes (CompressionMethodManager, Deflate, etc.) have been removed following RFC 8725 Section 3.6.
Dependency changes: fgrosse/phpasn1 replaced by spomky-labs/pki-framework, paragonie/constant_time_encoding removed, psr/http-client and psr/http-factory replaced by symfony/http-client-contracts.
Package consolidation: Individual packages (web-token/jwt-core, web-token/jwt-signature, etc.) are deprecated. Use web-token/jwt-library or web-token/jwt-experimental instead.

New Features

ECDH-SS (Static-Static) key agreement algorithms: ECDH-SS, ECDH-SS+A128KW, ECDH-SS+A192KW, ECDH-SS+A256KW
New generic checkers: CallableChecker and IsEqualChecker
Code modernization: readonly classes, constructor promotion, #[Override] attributes

Pull Requests

572: Update dependencies and CI/CD thanks to @Spomky
564: Restore repositories to .gitsplit.yml thanks to @Spomky
557: Add new testing options and refactor code for clarity. thanks to @Spomky
535: Deps/ecs rector dependencies thanks to @Spomky
529: Preparing 4.0.0 thanks to @Spomky
414: fgrosse/phpasn1 removed in favor of the S-L PKI framework thanks to @Spomky

3.4.4

Release Notes for 3.4.4

3.4.x bugfix release (patch)

3.4.4

Total issues resolved: 0
Total pull requests resolved: 2
Total contributors: 1

bug

574: Replace PHP_EOL with "\n" in certificate processing thanks to @Spomky
562: Update trigger for gitsplit workflow thanks to @Spomky

3.4.3

Release Notes for 3.4.3

3.4.x bugfix release (patch)

3.4.3

Total issues resolved: 0
Total pull requests resolved: 1
Total contributors: 1
558: Explicitly mark parameter as nullable thanks to @nicolas-grekas

3.4.2

Release Notes for 3.4.2

3.4.x bugfix release (patch)

3.4.2

Total issues resolved: 0
Total pull requests resolved: 1
Total contributors: 1

bug,in progress

556: Avoid PHP warnings about undefined array keys when sanitizing malformed PEMs thanks to @crocodele

3.4.1

Release Notes for 3.4.1

3.4.x bugfix release (patch)

3.4.1

Total issues resolved: 1
Total pull requests resolved: 1
Total contributors: 2

bug

554: Remove UTF-8 encoding check in JWEBuilder thanks to @Spomky
553: It isn't possible to encrypt binary data !? thanks to @user163

3.4.0

Release Notes for 3.4.0

Feature release (minor)

3.4.0

Total issues resolved: 1
Total pull requests resolved: 1
Total contributors: 1

enhancement

550: Add PSR6 alternative to cache JWKSet thanks to @qdequippe

3.3.5

Release Notes for 3.3.5

3.3.x bugfix release (patch)

3.3.5

Total issues resolved: 1
Total pull requests resolved: 1
Total contributors: 2

bug

548: Update and improve RSA keys handling and support thanks to @Spomky and @jonasf21

3.3.4

Release Notes for 3.3.4

3.3.x bugfix release (patch)

3.3.4

Total issues resolved: 0
Total pull requests resolved: 1
Total contributors: 1
544: Refactor encryption algorithms configuration thanks to @Spomky

3.3.3

Release Notes for 3.3.3

3.3.x bugfix release (patch)

3.3.3

Total issues resolved: 0
Total pull requests resolved: 2
Total contributors: 1

bug

542: Fix inconsistencies in last deprecation notices thanks to @Spomky
540: Update GitHub workflows configuration thanks to @Spomky

3.3.2

Release Notes for 3.3.2

3.3.x bugfix release (patch)

3.3.2

Total issues resolved: 0
Total pull requests resolved: 1
Total contributors: 1

Compliance

539: Deprecate compression thanks to @Spomky

3.3.1

Release Notes for 3.3.1

3.3.x bugfix release (patch)

3.3.1

Total issues resolved: 0
Total pull requests resolved: 1
Total contributors: 1

bug

532: Add missing AsCommand attributes for commands thanks to @temp

3.3.0

Release Notes for 3.3.0

Feature release (minor)

3.3.0

Total issues resolved: 2
Total pull requests resolved: 22
Total contributors: 4

DX

526: Remove old packages references thanks to @Spomky
511: Deps/remove useless checks thanks to @Spomky
510: Rename bundle and library folders thanks to @Spomky
509: Features/merge algorithms thanks to @Spomky
508: Merge small libs to jwt-library thanks to @Spomky
507: Merge ECC to jwt-core thanks to @Spomky
467: Prevent bad design by using named constructors thanks to @Spomky

Weaver

How can I help you explore Laravel packages today?

Conversation history is not saved when not logged in.

Add packages to context

No packages found.

microsoft/fluentui-system-icons

mmccook/php-json-canonicalization-scheme

middlewares/firewall

qubiqx/montapacking

nyoncode/laravel-package-console

pnscripts/filament-broadquill-lite

pnscripts/laravel-sentfold-lite

vleap/mx-sdk-laravel-internal

twidpay/utils

htetmyathlaing/scout-elasticsearch-driver

artisan-toolbox/front-awesome

ls/client-assistant

users-au/laravel-client

cgv/localized-resource

noith/settings

kda/laravel-package

kda/filament-dynamic-navigation

bypersoft/signbox

pairus/product-data

fayne/laravel-filament-cms-core