PHPackages                             rob006/yii2-simple-auth - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Authentication & Authorization](/categories/authentication)
4. /
5. rob006/yii2-simple-auth

ActiveYii2-extension[Authentication & Authorization](/categories/authentication)

rob006/yii2-simple-auth
=======================

Yii 2 extension that provides simple authentication based on a secret key.

1.0.0(9y ago)25.7k↑278.6%[1 issues](https://github.com/rob006-software/yii2-simple-auth/issues)1MITPHP

Since Sep 4Pushed 8y ago2 watchersCompare

[ Source](https://github.com/rob006-software/yii2-simple-auth)[ Packagist](https://packagist.org/packages/rob006/yii2-simple-auth)[ RSS](/packages/rob006-yii2-simple-auth/feed)WikiDiscussions master Synced 2d ago

READMEChangelog (1)Dependencies (1)Versions (2)Used By (1)

Simple authentication extension for Yii 2
=========================================

[](#simple-authentication-extension-for-yii-2)

Yii 2 extension that provides simple authentication based on a secret key.

The extension provides components for easy authenticate and validate the HTTP request. Each request gets its own unique token with the expiration time, so no passwords or keys are sent with the request - it should be safer than [basic access authentication](https://en.wikipedia.org/wiki/Basic_access_authentication)when you don't use https.

Installation
------------

[](#installation)

The preferred way to install this extension is through [composer](http://getcomposer.org/download/).

Either run

```
php composer.phar require rob006/yii2-simple-auth
```

or add

```
"rob006/yii2-simple-auth": "^1.0"
```

to the require section of your `composer.json` file.

Usage
-----

[](#usage)

### Configuration

[](#configuration)

You can configure default secret key used by this extension by setting param in your config in `config/web.php` and/or in `config/console.php`:

```
return [
	...
	'params' => [
		...
		'simpleauth' => [
			'secret' => 'mysecretkey',
		],
	],
];
```

This is optional - you can always explicitly specify the key for authentication/validation.

### Authentication (client side)

[](#authentication-client-side)

#### Authentication when using official `yii2-httpclient` extension

[](#authentication-when-using-official-yii2-httpclient-extension)

You can simply authenticate `Request` object from official Yii 2 [httpclient](https://github.com/yiisoft/yii2-httpclient)by using [yii2-simple-auth-yii-authenticator](https://github.com/rob006/yii2-simple-auth-yii-authenticator)extension.

#### Authentication any request

[](#authentication-any-request)

You can use `Authenticator` to authenticate any request, even if you don't use `yii2-httpclient`package. For example, authentication cURL request by GET param:

```
use rob006\simpleauth\Authenticator;

$ch = curl_init();
$url = 'http://api.example.com/user/list/?ids=1,2,3,4';
$url .= '&' . Authenticator::PARAM_NAME . '=' . Authenticator::generateAuthToken($url);
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$response = curl_exec($ch);
curl_close($ch);
```

Authentication cURL request by header:

```
use rob006\simpleauth\Authenticator;

$ch = curl_init();
$url = 'http://api.example.com/user/list/?ids=1,2,3,4';
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_HTTPHEADER, [
	Authenticator::HEADER_NAME . ': ' . Authenticator::generateAuthToken($url),
]);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$response = curl_exec($ch);
curl_close($ch);
```

### Validation (server side)

[](#validation-server-side)

To check whether the request has a valid token simply add action filter to your controller:

```
use rob006\simpleauth\ActionFilter;

class MyController extends \yii\web\Controller {

	public function behaviors() {
		return [
			...
			'simpleauth' => [
				'class' => ActionFilter::className(),
			],
		];
	}

	...
}
```

You can also configure some settings for `ActionFilter`:

```
use rob006\simpleauth\ActionFilter;
use rob006\simpleauth\Authenticator;

class MyController extends \yii\web\Controller {

	public function behaviors() {
		return [
			...
			'simpleauth' => [
				'class' => ActionFilter::className(),
				// allow authentication only by header
				'allowedMethods' => [
					Authenticator::METHOD_HEADER,
				],
				// set token timeout to 1 hour (by default it is 5 minutes)
				'tokenDuration' => 3600,
				// override default header used for authentication
				'headerName' => 'X-My-Custom-Header',
				// override params names used for send authentication token
				'postParamName' => 'my_custom_token_param_name',
				'getParamName' => 'my_custom_token_param_name',
				// custom secret used for validate authentication
				'secret' => 'my-custom-secret-key',
			],
		];
	}

	...
}
```

### Final comments

[](#final-comments)

Make sure that you generate token for final URL and no redirections are performed for the request. Token is generated for the exact address, so tokens for:

- `http://example.com/user/list/`
- `https://example.com/user/list/`
- `http://www.example.com/user/list/`
- `http://example.com/user/list`

will be completely different.

Be careful when using POST request. `Authenticator` and `ActionFilter` takes into account only the URL, all POST data is ignored during the authentication and validation. This means that one token may be used many times for different requests with different POST data if refer to the same URL.

###  Health Score

31

—

LowBetter than 66% of packages

Maintenance10

Infrequent updates — may be unmaintained

Popularity25

Limited adoption so far

Community12

Small or concentrated contributor base

Maturity63

Established project with proven stability

 Bus Factor1

Top contributor holds 95.8% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Unknown

Total

1

Last Release

3590d ago

### Community

Maintainers

![](https://www.gravatar.com/avatar/5b6f0a1cac6366571b3681228cdfc493f7e018e4c966f35e75e95f918ae417ff?d=identicon)[rob006](/maintainers/rob006)

---

Top Contributors

[![rob006](https://avatars.githubusercontent.com/u/5972388?v=4)](https://github.com/rob006 "rob006 (23 commits)")[![carriera](https://avatars.githubusercontent.com/u/9196254?v=4)](https://github.com/carriera "carriera (1 commits)")

---

Tags

authenticationyii2yii2-extensionauthAuthenticationyii2extension

### Embed Badge

![Health badge](/badges/rob006-yii2-simple-auth/health.svg)

```
[![Health](https://phpackages.com/badges/rob006-yii2-simple-auth/health.svg)](https://phpackages.com/packages/rob006-yii2-simple-auth)
```

###  Alternatives

[kakadu-dev/yii2-jwt-auth

Extension provide JWT auth for Yii2

105.8k](/packages/kakadu-dev-yii2-jwt-auth)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)