PHPackages udarajay/dunbar - PHPackages - PHPackages [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register) 1. [Directory](/) 2. / 3. [Authentication & Authorization](/categories/authentication) 4. / 5. udarajay/dunbar ActiveLibrary[Authentication & Authorization](/categories/authentication) udarajay/dunbar =============== Easy to use proxy for your Laravel APIs v0.6.1(6y ago)296MITPHPPHP >=7.0.0 Since Oct 30Pushed 6y agoCompare [ Source](https://github.com/UdaraJay/Dunbar)[ Packagist](https://packagist.org/packages/udarajay/dunbar)[ RSS](/packages/udarajay-dunbar/feed)WikiDiscussions master Synced yesterday READMEChangelog (1)Dependencies (2)Versions (3)Used By (0) [![](public/image/dunbar.webp)](public/image/dunbar.webp) Dunbar ====== [](#dunbar) ### Easy to use (thin) proxy for your Laravel APIs. [](#easy-to-use-thin-proxy-for-your-laravel-apis) [![Latest Stable Version](https://camo.githubusercontent.com/396432a1cb3eac331e87e7ee13e1088ac866537112cffcddc4c9d94f2a24bd9a/68747470733a2f2f706f7365722e707567782e6f72672f75646172616a61792f64756e6261722f76657273696f6e)](https://packagist.org/packages/udarajay/dunbar)[![Total Downloads](https://camo.githubusercontent.com/3281fce211f30eabefca116f53ee34123f9fe712974b7d00047a0a4b3ae8397e/68747470733a2f2f706f7365722e707567782e6f72672f75646172616a61792f64756e6261722f646f776e6c6f616473)](https://packagist.org/packages/udarajay/dunbar)[![License](https://camo.githubusercontent.com/59800257a8fa42b63b9fe7b2c331888cb10be479d0652958e093276a8f8f4b00/68747470733a2f2f706f7365722e707567782e6f72672f75646172616a61792f64756e6261722f6c6963656e7365)](https://packagist.org/packages/udarajay/dunbar) If you're consuming your Laravel API from any public client, like a single-page web app or a mobile/desktop app, chances are you're going to have to store the `client-secret` credentials somewhere in there. It's super easy for anyone to inspect you code and grab your secure tokens. Using a 'thin' (server-side) proxy is the fastest way to secure your client APIs; simply put, this poxy will sit between your frontend clients and backend apis. Where you would normally make an authentication call to the API with a `client-id` and `client-secret` like so: ``` POST /auth HTTP/1.1 Host: api.example.com grant_type=password &client_id=webapp &client_secret=a-secret-code-no-one-should-see &username=admin &password=password ``` You'd now be making the same API call to the proxy endpoint, in our case `example.com/dunbar`, **minus the client-secret**. The proxy will take the request, add the `client-secret` and forward the request to your backend API. The server would **normally** respond with the access tokens and refresh tokens like so: ``` { "access_token": "Jcncdj32CXdsdiUYtxnt6H8vCjndiCbdsu", "refresh_token": "83JCd97cdkalc53nB2DHJui3d83NcdicS", "token_type": "Bearer", "expires": 1535645629 } ``` But with our thin proxy, it'll simply create an encrypted cookie that only the proxy can decrypt. Now, for all future call to the API: ``` GET /ajax/resource/123 HTTP/1.1 Cookie: Host: example.com ``` The `proxy` will decrypt the cookie, add the Authorization header to the request and forward it on to the API like so: ``` GET /resource/some-protected-resource HTTP/1.1 Authorization: Bearer the-access-token-form-the-cookie Host: api.example.com ``` The responses will be passed directly back to the browser or app exactly like you define in your API. ### So what exactly does this "thin" proxy do? [](#so-what-exactly-does-this-thin-proxy-do) Simply put, the proxy lets you hard code the client-secret credentials into this thin server-side component (proxy) that you can trust. It authenticates your client APIs for you and returns an encrypted cookie with the user credentials (eg. access token) that only the proxy can decrypt. All you need to do to access protected resources after you've authenticated via the proxy is to pass this cookie with all your calls. ### What more? [](#what-more) Teh further secure your API, you can lock it down to only accept requests from the proxy. Additionally you can also roll your client-secret on a schedule or anytime you need to without having to update any front-end clients. Installation ------------ [](#installation) 1. Install `Dunbar` via composer ``` composer require udarajay/dunbar ``` 2. Publish the configuration ``` php artisan vendor:publish ``` 3. Edit the file `app/config/dunbar.php` to suit your needs. Primarily you can edit it to change the name of the cookie and the proxy endpoint. You may also need to regenrate your route and config cache on Laravel using `php artisan config:clear` and `php artisan route:cache`. Usage ----- [](#usage) The package will automatically register a proxy endpoint (default being `yourdomain.com/dunbar`). Make all your API calls to the proxy endpoint like so to authenticate: ``` POST dunbar/example.com/oauth/token HTTP/1.1 Host: example.com &grant_type=password &client_id=webapp &username=admin &password=mypassword ``` And requests to all protected resources like so: ``` POST dunbar/example.com/protected_resource HTTP/1.1 Host: example.com ``` If the `access_token` expires and you have got a `refresh_token`, `Dunbar` will call the OAuth server for you and refresh the `access_token` with a new one and update the cookie. Features -------- [](#features) - Dead-simple proxy for securing your Laravel API. Works seamlessly with Passport or the League OAuth2 server that is maintained by Andy Millington and Simon Hamp. - \[ Upcoming\] Interact with database (Passport defaults first), to access client secrets directly from the OAuth provider. - \[ Upcoming\] Auto-roll client secrets on a schedule. Questions? ---------- [](#questions) Create an issue and tag it with `question`. I'll try to help & answer best I can. Contribute? ----------- [](#contribute) Please do :) Just create a PR. License ------- [](#license) This package is released under the MIT License. ### Health Score 23 — LowBetter than 27% of packages Maintenance20 Infrequent updates — may be unmaintained Popularity12 Limited adoption so far Community6 Small or concentrated contributor base Maturity44 Maturing project, gaining track record Bus Factor1 Top contributor holds 100% of commits — single point of failure How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window. **Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores. **Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement. **Maturity (30%)** — Project age, version count, PHP version support, and release stability. ### Release Activity Cadence Every ~0 days Total 2 Last Release 2387d ago ### Community Maintainers ![](https://www.gravatar.com/avatar/f0ea19674fcfb356a2caabc7e28e31245282f69a0543164c94f1b580fbfda5ba?d=identicon)[UdaraJay](/maintainers/UdaraJay) --- Top Contributors [![UdaraJay](https://avatars.githubusercontent.com/u/1122227?v=4)](https://github.com/UdaraJay "UdaraJay (5 commits)") --- Tags laraveloauthpassportproxyapilaravelproxyoauthpassport ### Embed Badge ![Health badge](/badges/udarajay-dunbar/health.svg) ``` [![Health](https://phpackages.com/badges/udarajay-dunbar/health.svg)](https://phpackages.com/packages/udarajay-dunbar) ``` PHPackages © 2026 [Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)