PHPackages galcvua/jwt-refresh-bundle - PHPackages - PHPackages [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register) 1. [Directory](/) 2. / 3. [Authentication & Authorization](/categories/authentication) 4. / 5. galcvua/jwt-refresh-bundle ActiveSymfony-bundle[Authentication & Authorization](/categories/authentication) galcvua/jwt-refresh-bundle ========================== Refresh JWT & logout support for Symfony security v1.0.0(5mo ago)00MITPHPPHP ^8.3CI passing Since Nov 23Pushed 5mo agoCompare [ Source](https://github.com/galcvua/jwt-refresh-bundle)[ Packagist](https://packagist.org/packages/galcvua/jwt-refresh-bundle)[ RSS](/packages/galcvua-jwt-refresh-bundle/feed)WikiDiscussions master Synced 1mo ago READMEChangelogDependencies (12)Versions (4)Used By (0) [![Static Checks](https://github.com/galcvua/jwt-refresh-bundle/actions/workflows/static-checks.yml/badge.svg)](https://github.com/galcvua/jwt-refresh-bundle/actions/workflows/static-checks.yml)[![PHPStan Level](https://camo.githubusercontent.com/1b02b2f6c2946c9b9ad2e14b1c79c5932fdcef4ea31b4d6e79d54af7d7e7a2a7/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f5048505374616e2d6c6576656c253230382d626c7565)](https://camo.githubusercontent.com/1b02b2f6c2946c9b9ad2e14b1c79c5932fdcef4ea31b4d6e79d54af7d7e7a2a7/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f5048505374616e2d6c6576656c253230382d626c7565)[![Tests](https://github.com/galcvua/jwt-refresh-bundle/actions/workflows/tests.yml/badge.svg)](https://github.com/galcvua/jwt-refresh-bundle/actions/workflows/tests.yml)[![codecov](https://camo.githubusercontent.com/667b87c1bb3e0a1af9bf6791c770e891503f0e940af8debe8319756568289300/68747470733a2f2f636f6465636f762e696f2f67682f67616c637675612f6a77742d726566726573682d62756e646c652f6272616e63682f6d61737465722f67726170682f62616467652e737667)](https://codecov.io/gh/galcvua/jwt-refresh-bundle) JWT Refresh Bundle ================== [](#jwt-refresh-bundle) This bundle manages refresh tokens for JWT (JSON Web Tokens) in the simplest and safest way. It integrates with the [LexikJWTAuthenticationBundle](https://github.com/lexik/LexikJWTAuthenticationBundle), using **HTTP-only cookies** backed by Symfony’s session system. No Doctrine ORM/ODM or external persistence is required, and your API remains stateless for regular requests. It is compatible with (and tested on) PHP 8.3+ and Symfony 7.3–8.0. Features -------- [](#features) - Refresh JWTs **without persisting** refresh tokens. - Logout endpoint that clears the refresh context. - Optional OpenAPI decoration for API Platform (refresh + logout operations). Requirements ------------ [](#requirements) - PHP 8.3+ - Symfony 7.3+ - [lexik/jwt-authentication-bundle](https://github.com/lexik/LexikJWTAuthenticationBundle) ^3.1 Installation ------------ [](#installation) ``` composer require galcvua/jwt-refresh-bundle ``` Register the bundle in config/bundles.php (Symfony Flex does this automatically): ``` return [ //... Galcvua\JwtRefreshBundle\GalcvuaJwtRefreshBundle::class => ['all' => true], ]; ``` Configuration ------------- [](#configuration) ``` # config/packages/galcvua_jwt_refresh.yaml (example) galcvua_jwt_refresh: open_api: refresh: enabled: true tags: - JWT Refresh logout: enabled: true tags: - JWT Refresh ``` ``` # config/packages/security.php (example) firewalls: dev: pattern: ^/(_(profiler|wdt)|css|images|js)/ security: false refresh_token: pattern: ^/api/token/ custom_authenticators: - galcvua_jwt_refresh.security.jwt_refresh_authenticator logout: path: /api/token/logout login: pattern: ^/api/login stateless: true json_login: check_path: /api/login_check success_handler: lexik_jwt_authentication.handler.authentication_success failure_handler: lexik_jwt_authentication.handler.authentication_failure ``` ``` # config/routes.yaml (example) api_token_refresh: path: /api/token/refresh methods: POST controller: galcvua_jwt_refresh.controller.jwt_refresh api_login_check: path: /api/login_check methods: POST controllers: resource: path: ../src/Controller/ namespace: App\Controller type: attribute ``` ### Session Cookie Path [](#session-cookie-path) By default, Symfony issues the session cookie for the root path `/`. If you want the refresh context to be isolated from the rest of your application, you can restrict the cookie path to the refresh firewall only. This can be done by overriding the cookie options in `framework.session`: ``` # config/packages/framework.yaml framework: session: cookie_path: '/api/token' ``` Usage ----- [](#usage) 1. Authenticate via /api/login\_check to obtain an access token (from Lexik). 2. Send a POST request to /api/token/refresh to receive a new token. 3. Call /api/token/logout to clear the refresh session. Testing ------- [](#testing) The bundle includes unit and functional tests. When testing your own application, avoid using mock session storage, because it does not mimic real browser behavior and may cause inconsistent results with stateless firewalls. ### Health Score 34 — LowBetter than 77% of packages Maintenance70 Regular maintenance activity Popularity0 Limited adoption so far Community6 Small or concentrated contributor base Maturity52 Maturing project, gaining track record Bus Factor1 Top contributor holds 100% of commits — single point of failure How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window. **Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores. **Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement. **Maturity (30%)** — Project age, version count, PHP version support, and release stability. ### Release Activity Cadence Every ~2 days Total 3 Last Release 170d ago Major Versions v0.1.1-beta1 → v1.0.02025-11-27 ### Community Maintainers ![](https://www.gravatar.com/avatar/2652c74b7d76df7138c6d9d48aa8228a62651bea0ba8c3d3628925195c83f121?d=identicon)[galcvua](/maintainers/galcvua) --- Top Contributors [![galcvua](https://avatars.githubusercontent.com/u/107037248?v=4)](https://github.com/galcvua "galcvua (12 commits)") --- Tags jwtsymfonysymfony-bundle ### Code Quality Code StylePHP CS Fixer ### Embed Badge ![Health badge](/badges/galcvua-jwt-refresh-bundle/health.svg) ``` [![Health](https://phpackages.com/badges/galcvua-jwt-refresh-bundle/health.svg)](https://phpackages.com/packages/galcvua-jwt-refresh-bundle) ``` ### Alternatives [sylius/sylius E-Commerce platform for PHP, based on Symfony framework. 8.4k5.6M651](/packages/sylius-sylius)[simplesamlphp/simplesamlphp A PHP implementation of a SAML 2.0 service provider and identity provider. 1.1k12.4M193](/packages/simplesamlphp-simplesamlphp)[gesdinet/jwt-refresh-token-bundle Implements a refresh token system over Json Web Tokens in Symfony 70516.4M35](/packages/gesdinet-jwt-refresh-token-bundle)[sulu/sulu Core framework that implements the functionality of the Sulu content management system 1.3k1.3M152](/packages/sulu-sulu)[scheb/2fa Two-factor authentication for Symfony applications (please use scheb/2fa-bundle to install) 578630.7k1](/packages/scheb-2fa)[prestashop/prestashop PrestaShop is an Open Source e-commerce platform, committed to providing the best shopping cart experience for both merchants and customers. 9.0k15.4k](/packages/prestashop-prestashop) PHPackages © 2026 [Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)