PHPackages                             connectholland/secure-jwt-bundle - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Security](/categories/security)
4. /
5. connectholland/secure-jwt-bundle

ArchivedLibrary[Security](/categories/security)

connectholland/secure-jwt-bundle
================================

Bundle to increase security of JWT based security

0.3.0(3y ago)6368[5 issues](https://github.com/Harborn-digital/secure-jwt-bundle/issues)[3 PRs](https://github.com/Harborn-digital/secure-jwt-bundle/pulls)proprietaryPHPPHP ^7.4

Since Sep 3Pushed 2y ago4 watchersCompare

[ Source](https://github.com/Harborn-digital/secure-jwt-bundle)[ Packagist](https://packagist.org/packages/connectholland/secure-jwt-bundle)[ RSS](/packages/connectholland-secure-jwt-bundle/feed)WikiDiscussions master Synced yesterday

READMEChangelog (10)Dependencies (11)Versions (17)Used By (0)

Secure JWT Bundle
=================

[](#secure-jwt-bundle)

Symfony bundle that makes JWT more secure

Install
-------

[](#install)

Installation is not fluent and error free yet, but it is easy to work around:

```
composer require connectholland/secure-jwt-bundle
```

Will give error in post installation:

```
Cannot autowire service "ConnectHolland\SecureJWTBundle\EventSubscriber\LoginSubscriber": argument "$googleAuthenticator" of method "__construct()" references class "Scheb\TwoFactorBundle\Security\TwoFactor\Provider\Google\GoogleAuthenticator" but no such service exists.

```

Configure scheb twofactor Google:

In the `scheb_two_factor.yaml` file:

```
scheb_two_factor:
    security_tokens:
        - Symfony\Component\Security\Core\Authentication\Token\UsernamePasswordToken
    google:
        enabled: true
        server_name: Secure Server
        issuer: Connect Holland
        digits: 6
        window: 1
```

Run

```
composer require connectholland/secure-jwt-bundle
```

Again to finish the installation.

BTW1: Installation and configuration of the scheb twofactor bundle before installation of this bundle will also prevent this error.
BTW2: of course a PR that fixes these issues is welcome :)

Cookie storage
--------------

[](#cookie-storage)

Tokens in local storage are insecure, so if you use tokens from a web interface you should store them somewhere else. A secure cookie is a good location. Configure cookie storage as follows:

### Let the lexik/jwt-authentication-bundle look at cookies:

[](#let-the-lexikjwt-authentication-bundle-look-at-cookies)

In the `lexik_jwt_authentication.yaml` config file:

```
lexik_jwt_authentication:
    secret_key: '%env(resolve:JWT_SECRET_KEY)%'
    public_key: '%env(resolve:JWT_PUBLIC_KEY)%'
    pass_phrase: '%env(JWT_PASSPHRASE)%'

    token_extractors:
            # Default header auth, can be useful to allow for other auth types (for example /api)
            authorization_header:
                enabled: true

            # Make sure this is enabled
            cookie:
                enabled: true
                name:    BEARER
                set_cookies:
                    BEARER: ~
```

### Make sure the token is set as a secure cookie

[](#make-sure-the-token-is-set-as-a-secure-cookie)

In the `security.yaml` config file:

```
    login:
        pattern:  ^/api/login
        stateless: true
        anonymous: true
        json_login:
            check_path:               /api/login_check
            success_handler:          lexik_jwt_authentication.handler.authentication_success
            failure_handler:          lexik_jwt_authentication.handler.authentication_failure
```

Invalidate tokens
-----------------

[](#invalidate-tokens)

By default tokens are valid until they expire. This makes is impossible to really log out. You can configure token invalidatation to allow logouts:

### Create database table

[](#create-database-table)

In the `doctrine.yaml` file:

```
doctrine:
    orm:
        mappings:
            ConnectHolland\SecureJWTBundle:
                is_bundle: true
                type: annotation
                dir: '%kernel.project_dir%/vendor/connectholland/secure-jwt-bundle/src/Entity'
                prefix: 'ConnectHolland\SecureJWTBundle\Entity'
                alias: SecureJWTBundle
```

And run migrations:

```
bin/console doctrine:migrations:diff
bin/console doctrine:migrations:migrate -n
```

### Configure API endpoint logout

[](#configure-api-endpoint-logout)

In the `api_platform.yaml` file:

```
api_platform:
    mapping:
        paths: ['%kernel.project_dir%/vendor/connectholland/secure-jwt-bundle/src/Message']
```

Of course do not remove other required paths that might already be in the `paths` configuration.

There will be a `logout` endpoint in your API. This endpoint requires a message formatted like:

```
{
  "logout": "some string"
}
```

The value of logout is not important and not used. This field is required because API platform requires at least one field in the message. (A better solution for this is welcome).

### Do not allow invalidated tokens

[](#do-not-allow-invalidated-tokens)

In the `security.yaml` file:

```
    api:
        pattern: ^/api
        stateless: true
        anonymous: true
        guard:
            authenticators:
                - ConnectHolland\SecureJWTBundle\Security\Guard\JWTTokenAuthenticator
```

Two Factor Authentication in JWT
--------------------------------

[](#two-factor-authentication-in-jwt)

### Configure Google Authenticator

[](#configure-google-authenticator)

In the `scheb_two_factor.yaml` file:

```
scheb_two_factor:
    security_tokens:
        - Symfony\Component\Security\Core\Authentication\Token\UsernamePasswordToken
    google:
        enabled: true
        server_name: Secure Server
        issuer: Connect Holland
        digits: 6
        window: 1
```

### Use the two\_factor\_jwt security listener and provider

[](#use-the-two_factor_jwt-security-listener-and-provider)

In the `security.yaml` file:

```
    login:
        pattern:  ^/api/login
        stateless: true
        anonymous: true
        two_factor_jwt:
            check_path:               /api/login_check
            success_handler:          ConnectHolland\SecureJWTBundle\Security\Http\Authentication\AuthenticationSuccessHandler
            failure_handler:          ConnectHolland\SecureJWTBundle\Security\Http\Authentication\AuthenticationFailureHandler
```

### Implement the right interfaces

[](#implement-the-right-interfaces)

Your User object should implement `ConnectHolland\SecureJWTBundle\Entity\TwoFactorUserInterface`.

Using 2FA
---------

[](#using-2fa)

```
curl -X POST http://host/api/users/authenticate -H 'Content-Type: application/json' -d '{"username": "username", "password": "password"}'
```

This will give the following response:

```
{
  "result":"ok",
  "status":"two factor authentication required"
}
```

If 2FA is not yet setup you will receive:

```
{
  "result":"ok",
  "message":"use provided QR code to set up two factor authentication",
  "qr":"QR code (data URL)"
}
```

In the next call add the two factor challenge:

```
curl -X POST http://host/api/users/authenticate -H 'Content-Type: application/json' -d '{"username": "username", "password": "password", "challenge": "123456"}'
```

If correct you'll receive:

```
{
  "result":"ok"
}
```

The response headers will include a secure cookie containing the JWT token to allow future authenticated calls.

2FA Remember this device
------------------------

[](#2fa-remember-this-device)

The remember device functionality allows users to skip the 2fa for a configurable amount of days. The default configuration is set to false, which means it doesn't set a REMEMBER\_DEVICE cookie after logging in. The default amount of days is set to 30.

To configure:

In the config/packages folder of the root project create a new file called: `connect_holland_secure_jwt.yaml`

In this file the configuration can be set:

```
connect_holland_secure_jwt:
  is_remembered: true
  expiry_days: 14
```

As mentioned before, after logging in a REMEMBER\_DEVICE cookie will be set. It will contain a unix expiry time and the email of the user.

Besides placing the cookie it will be persisted in the: `secure_jwt_remember_device_token` table. This entity can be found in `src/Entity/RememberDeviceToken.php`

Recover codes
-------------

[](#recover-codes)

You can retrieve recovery codes for 2FA which allow you to reset 2FA. If a valid recovery code is entered as `challenge`, 2FA will be reset and you'll get a QR code response.

###  Health Score

24

—

LowBetter than 32% of packages

Maintenance3

Infrequent updates — may be unmaintained

Popularity16

Limited adoption so far

Community17

Small or concentrated contributor base

Maturity53

Maturing project, gaining track record

 Bus Factor1

Top contributor holds 66.1% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Every ~76 days

Recently: every ~93 days

Total

11

Last Release

1310d ago

### Community

Maintainers

![](https://www.gravatar.com/avatar/32c77f5ff7ffcce6bdf072dd76718e014643cb4b3083b27ecf1806606a5ce363?d=identicon)[RonRademaker](/maintainers/RonRademaker)

---

Top Contributors

[![RonRademaker](https://avatars.githubusercontent.com/u/2697738?v=4)](https://github.com/RonRademaker "RonRademaker (72 commits)")[![mrcotrmpr](https://avatars.githubusercontent.com/u/55551559?v=4)](https://github.com/mrcotrmpr "mrcotrmpr (32 commits)")[![Luc1405](https://avatars.githubusercontent.com/u/74653523?v=4)](https://github.com/Luc1405 "Luc1405 (3 commits)")[![basekkelenkamp](https://avatars.githubusercontent.com/u/57452503?v=4)](https://github.com/basekkelenkamp "basekkelenkamp (2 commits)")

---

Tags

managedteam-tbd

###  Code Quality

TestsPHPUnit

Static AnalysisRector

### Embed Badge

![Health badge](/badges/connectholland-secure-jwt-bundle/health.svg)

```
[![Health](https://phpackages.com/badges/connectholland-secure-jwt-bundle/health.svg)](https://phpackages.com/packages/connectholland-secure-jwt-bundle)
```

###  Alternatives

[sylius/sylius

E-Commerce platform for PHP, based on Symfony framework.

8.4k5.6M651](/packages/sylius-sylius)[sulu/sulu

Core framework that implements the functionality of the Sulu content management system

1.3k1.3M152](/packages/sulu-sulu)[prestashop/prestashop

PrestaShop is an Open Source e-commerce platform, committed to providing the best shopping cart experience for both merchants and customers.

9.0k15.4k](/packages/prestashop-prestashop)[codeconsortium/ccdn-user-security-bundle

CCDN User Security Bundle

60100.7k](/packages/codeconsortium-ccdn-user-security-bundle)[components-web-app/api-components-bundle

Creates a flexible API for a website's structure, reusable components and common functionality.

322.8k](/packages/components-web-app-api-components-bundle)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)