PHPackages ptondereau/biscuit-symfony-bundle - PHPackages - PHPackages [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register) 1. [Directory](/) 2. / 3. [Authentication & Authorization](/categories/authentication) 4. / 5. ptondereau/biscuit-symfony-bundle ActiveSymfony-bundle[Authentication & Authorization](/categories/authentication) ptondereau/biscuit-symfony-bundle ================================= Symfony bundle for Biscuit authorization tokens v0.2.2(1mo ago)010Apache-2.0PHPPHP >=8.1CI passing Since May 6Pushed 1mo agoCompare [ Source](https://github.com/ptondereau/biscuit-sf-bundle)[ Packagist](https://packagist.org/packages/ptondereau/biscuit-symfony-bundle)[ RSS](/packages/ptondereau-biscuit-symfony-bundle/feed)WikiDiscussions main Synced 3w ago READMEChangelog (5)Dependencies (14)Versions (9)Used By (0) Biscuit Symfony Bundle ====================== [](#biscuit-symfony-bundle) Symfony bundle for [Biscuit](https://www.biscuitsec.org/) authorization tokens. [![CI](https://github.com/ptondereau/biscuit-sf-bundle/actions/workflows/ci.yml/badge.svg)](https://github.com/ptondereau/biscuit-sf-bundle/actions/workflows/ci.yml)[![Coverage Status](https://camo.githubusercontent.com/83f557f705083451c0fbf057bd224d7d8692f4cf3ac037456e45cf0ac4e462a6/68747470733a2f2f636f766572616c6c732e696f2f7265706f732f6769746875622f70746f6e6465726561752f626973637569742d73662d62756e646c652f62616467652e7376673f6272616e63683d6d61696e)](https://coveralls.io/github/ptondereau/biscuit-sf-bundle?branch=main)[![Latest Version](https://camo.githubusercontent.com/1eaa30c5212ab0eadbf6043fba999d2634b8fb9d0c20cb99feb3440676a82825/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f762f70746f6e6465726561752f626973637569742d73796d666f6e792d62756e646c652e737667)](https://packagist.org/packages/ptondereau/biscuit-symfony-bundle)[![PHP Version](https://camo.githubusercontent.com/33ca215af517ac1ec3a7ab4c2cbd9b8c0e06711b25f5ba2b3876f8026326f2e0/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f7068702d762f70746f6e6465726561752f626973637569742d73796d666f6e792d62756e646c652e737667)](https://packagist.org/packages/ptondereau/biscuit-symfony-bundle)[![License](https://camo.githubusercontent.com/b29de0acdfd19013f1f02689b15c933e4a6c145be9efa718288f88ba3280b1c5/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f6c6963656e73652d417061636865253230322e302d626c75652e737667)](LICENSE) About ----- [](#about) Biscuit is a bearer token format with offline attenuation, third-party blocks, and a Datalog-based authorization language. This bundle integrates Biscuit into Symfony's Security component so you can authenticate requests carrying Biscuit tokens and enforce policies through the standard `#[IsGranted]` attribute. What you get: - Token extraction from `Authorization` header and/or cookies - Symfony authenticator that validates the token's signature against your public key - A `BiscuitVoter` that runs your Datalog policies against the request, fully driven by `#[IsGranted]` - Token attenuation through reusable block templates, with an event for audit and a console command for debugging - Configurable token caching and revocation checking - A web profiler panel showing the current token, its blocks, every policy decision, and every attenuation performed during the request - Console commands to generate keys, mint tokens from templates, attenuate tokens, and inspect tokens - A `make:biscuit-policy` maker - Test helpers to mint tokens and authenticate functional tests Read the Datalog reference at [biscuitsec.org/docs/reference/datalog](https://www.biscuitsec.org/docs/reference/datalog/). Requirements ------------ [](#requirements) - PHP 8.1 or higher - Symfony 6.4, 7.4, or 8.0 - The `biscuit-php` PHP extension (version 0.5.0) Installation ------------ [](#installation) Install the PHP extension via [pie](https://github.com/php/pie): ``` pie install ptondereau/biscuit-php:0.5.0 ``` Install the bundle via Composer: ``` composer require ptondereau/biscuit-symfony-bundle ``` If you are not using Symfony Flex, register the bundle manually in `config/bundles.php`: ``` return [ // ... Biscuit\BiscuitBundle\BiscuitBundle::class => ['all' => true], ]; ``` Quick Start ----------- [](#quick-start) Generate a key pair: ``` bin/console biscuit:keys:generate ``` Configure the bundle (`config/packages/biscuit.yaml`): ``` biscuit: keys: public_key: '%env(BISCUIT_PUBLIC_KEY)%' private_key: '%env(BISCUIT_PRIVATE_KEY)%' policies: admin_only: 'allow if role("admin")' ``` Wire the authenticator into your firewall (`config/packages/security.yaml`): ``` security: firewalls: api: pattern: ^/api stateless: true custom_authenticators: - biscuit.authenticator ``` Protect a controller with `#[IsGranted]`: ``` use Symfony\Component\Routing\Attribute\Route; use Symfony\Component\Security\Http\Attribute\IsGranted; final class AdminController { #[Route('/api/admin', methods: ['GET'])] #[IsGranted('admin_only')] public function index(): Response { return new JsonResponse(['ok' => true]); } } ``` That's it. Requests without a valid token get `401`, requests whose token does not satisfy the policy get `403`. Configuration Reference ----------------------- [](#configuration-reference) ``` biscuit: keys: public_key: ~ # Public key in hex private_key: ~ # Private key in hex public_key_file: ~ # Path to public key file (alternative to public_key) private_key_file: ~ # Path to private key file (alternative to private_key) algorithm: ed25519 # ed25519 or secp256r1 security: token_extractor: header: true # Extract token from Authorization header cookie: false # Cookie name to read from, or false to disable cache: enabled: false # Enable token verification caching pool: cache.app # Cache pool service ID ttl: 3600 # Cache TTL in seconds revocation: enabled: false # Enable token revocation checking service: ~ # Revocation checker service ID policies: # Named policies referenced by #[IsGranted] admin_only: 'allow if role("admin")' scope_read: 'allow if scope({resource}, "read")' token_templates: # Templates used by BiscuitTokenFactory and biscuit:token:create admin_token: facts: - 'user({id})' - 'role("admin")' checks: - 'check if time($t), $t < {expiry}' rules: [] block_templates: # Templates used by BiscuitBlockFactory and biscuit:token:attenuate read_only: checks: - 'check if operation("read")' expires: checks: - 'check if now($t), $t factory->create('scoped_reader', [ 'id' => $userId, 'resource' => $dog, ]); return $token->toBase64(); } } ``` Block Templates and Attenuation ------------------------------- [](#block-templates-and-attenuation) A holder of a Biscuit can derive a more restricted token by appending a block. Attenuation can only narrow authority; it can never widen it. The bundle exposes this through `BiscuitBlockFactory`, fed by reusable block templates declared in configuration: ``` biscuit: block_templates: read_only: checks: - 'check if operation("read")' expires: checks: - 'check if now($t), $t createTestTokenBase64('user(1); role("admin")'); $client = static::createClient(); $client->request('GET', '/api/admin', server: [ 'HTTP_AUTHORIZATION' => 'Bearer ' . $token, ]); self::assertResponseIsSuccessful(); } } ``` `TestBiscuitAuthenticator` is a drop-in replacement for the production authenticator that trusts tokens signed by the test key pair. `BiscuitFixtures` and `BiscuitFixtureLoader` load Datalog scenarios from YAML files for repeatable fixture data. Development ----------- [](#development) Run the full quality gate locally: ``` composer check ``` This runs `php-cs-fixer` (dry run), `phpstan` at level 8, and the PHPUnit suite. To auto-fix style issues: ``` composer cs-fix ``` Contributing ------------ [](#contributing) See [CONTRIBUTING.md](CONTRIBUTING.md). All contributors are expected to follow the [Code of Conduct](CODE_OF_CONDUCT.md). Security -------- [](#security) Vulnerabilities should be reported to `security@biscuitsec.org`. See [SECURITY.md](SECURITY.md) for details. License ------- [](#license) Apache License 2.0. See [LICENSE](LICENSE). ### Health Score 36 — LowBetter than 79% of packages Maintenance88 Actively maintained with recent releases Popularity5 Limited adoption so far Community6 Small or concentrated contributor base Maturity38 Early-stage or recently created project Bus Factor1 Top contributor holds 100% of commits — single point of failure How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window. **Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores. **Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement. **Maturity (30%)** — Project age, version count, PHP version support, and release stability. ### Release Activity Cadence Every ~5 days Total 5 Last Release 58d ago ### Community Maintainers ![](https://avatars.githubusercontent.com/u/267503386?v=4)[rooferz](/maintainers/rooferz)[@Rooferz](https://github.com/Rooferz) --- Top Contributors [![ptondereau](https://avatars.githubusercontent.com/u/4287777?v=4)](https://github.com/ptondereau "ptondereau (32 commits)") ### Code Quality TestsPHPUnit Static AnalysisPHPStan Code StylePHP CS Fixer Type Coverage Yes ### Embed Badge ![Health badge](/badges/ptondereau-biscuit-symfony-bundle/health.svg) ``` [![Health](https://phpackages.com/badges/ptondereau-biscuit-symfony-bundle/health.svg)](https://phpackages.com/packages/ptondereau-biscuit-symfony-bundle) ``` ### Alternatives [easycorp/easyadmin-bundle Admin generator for Symfony applications 4.3k17.9M400](/packages/easycorp-easyadmin-bundle)[2lenet/crudit-bundle The easy like Crud'it Bundle. 1616.4k14](/packages/2lenet-crudit-bundle)[open-dxp/opendxp Content & Product Management Framework (CMS/PIM) 9421.6k64](/packages/open-dxp-opendxp) PHPackages © 2026 [Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)