PHPackages waffle-commons/auth - PHPackages - PHPackages [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register) 1. [Directory](/) 2. / 3. [Authentication & Authorization](/categories/authentication) 4. / 5. waffle-commons/auth ActiveLibrary[Authentication & Authorization](/categories/authentication) waffle-commons/auth =================== Auth component for Waffle framework. 0.1.0-beta5(2w ago)051MITPHPPHP ^8.5CI passing Since Jun 7Pushed 2w agoCompare [ Source](https://github.com/waffle-commons/auth)[ Packagist](https://packagist.org/packages/waffle-commons/auth)[ RSS](/packages/waffle-commons-auth/feed)WikiDiscussions main Synced 1w ago READMEChangelog (3)Dependencies (19)Versions (8)Used By (1) [![Discord](https://camo.githubusercontent.com/b30f41baece56d71f7f496f7e39fd33a2a096221c66c648b350dd4fe14276c2e/68747470733a2f2f696d672e736869656c64732e696f2f646973636f72642f3735353238383030313539323033333339313f6c6f676f3d646973636f7264)](https://discord.gg/eKgywnfXr2)[![PHP Version Require](https://camo.githubusercontent.com/a1293b0b7a335025ec49ac7f25050555838f5116158eea4b45be98b3dd43f0fd/687474703a2f2f706f7365722e707567782e6f72672f776166666c652d636f6d6d6f6e732f617574682f726571756972652f706870)](https://packagist.org/packages/waffle-commons/auth)[![PHP CI](https://github.com/waffle-commons/auth/actions/workflows/main.yml/badge.svg)](https://github.com/waffle-commons/auth/actions/workflows/main.yml)[![Latest Stable Version](https://camo.githubusercontent.com/f6d9a0d0630f25bc3efbce35a4515f5b214c0cfb91834fbd6ad995cdc52a5f1d/687474703a2f2f706f7365722e707567782e6f72672f776166666c652d636f6d6d6f6e732f617574682f76)](https://packagist.org/packages/waffle-commons/auth)[![Latest Unstable Version](https://camo.githubusercontent.com/9f08a88ccbd6fb19b7e1f7c1b571d219f8489d8c0b18483b6038664bc97769ff/687474703a2f2f706f7365722e707567782e6f72672f776166666c652d636f6d6d6f6e732f617574682f762f756e737461626c65)](https://packagist.org/packages/waffle-commons/auth)[![Total Downloads](https://camo.githubusercontent.com/4e15848a3d4cb30d1b08db8a91d2530bdeacef6f5a89362a22ce0019f42e0d14/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f64742f776166666c652d636f6d6d6f6e732f617574682e737667)](https://packagist.org/packages/waffle-commons/auth)[![Packagist License](https://camo.githubusercontent.com/74256fa69af55072f78c7a5d3f6bfc9cdd229edc26f8e65208443041f000df15/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f6c2f776166666c652d636f6d6d6f6e732f61757468)](https://github.com/waffle-commons/auth/blob/main/LICENSE.md) Waffle Auth Component ===================== [](#waffle-auth-component) > **Release:** `0.1.0-beta5` | [`CHANGELOG.md`](./CHANGELOG.md) The **Universal Authentication Bridge** (UAB, RFC-021): Waffle's entire authentication layer. Connect a Waffle application to popular authentication services **without technical debt** — natively, statelessly, fail-closed — in both directions: - **Inbound** — interchangeable authenticators for OAuth2/OIDC providers (Google, Microsoft, Keycloak, Auth0, …), JWT bearer tokens (HS256/RS256 + JWKS), HMAC-signed gateway assertions, API keys, and HTTP Basic. - **Outbound** — a host-gated PSR-18 `AuthenticatedClient` decorator that attaches credentials (signed assertion, Bearer token, API key, Basic) to outgoing requests. Authentication only: *who are you?* Authorization (*may you do this?*) remains in `waffle-commons/security` (RFC-002 ABAC). 📦 Installation -------------- [](#-installation) ``` composer require waffle-commons/auth ``` 🧱 Surface --------- [](#-surface) ClassRole`Waffle\Commons\Auth\SecurityContext`Request-scoped identity holder. Implements `ResettableInterface` — wiped between FrankenPHP worker loops (zero-leak).`Waffle\Commons\Auth\AuthenticationBridge`Orchestrator: runs registered authenticators in order; first `supports()` wins; rejection throws (fail-closed); none ⇒ anonymous.`Waffle\Commons\Auth\Middleware\AuthenticationMiddleware`PSR-15 entry point: bridge + `SecurityContext` + `_auth_identity` request attribute.`Waffle\Commons\Auth\Middleware\GatewayAssertionMiddleware`Downstream PSR-15 middleware verifying `X-Wfl-Assert-User` (signature, expiry, IP-binding) and hydrating the context.`Waffle\Commons\Auth\Uab\UserAssertion`Immutable assertion VO (PHP 8.5 hooks + asymmetric visibility): `usr`, `eml`, `rol`, `ten`, `iat`, `exp`, `iph`.`Waffle\Commons\Auth\Uab\AuthBridgeSigner`Signs assertions: `base64url(payload).hex(HMAC-SHA256)` with `WAFFLE_AUTH_SECRET`. Fail-closed boot (≥ 32-byte secret).`Waffle\Commons\Auth\Uab\AuthBridgeVerifier`Verifies assertions: `hash_equals()` MAC check, `exp`/`iat` window (≤ 5 s), keyed IP-hash binding.`Waffle\Commons\Auth\Authenticator\JwtAuthenticator``Authorization: Bearer` — HS256/RS256, strict alg allow-list, `alg:none` rejected, `iss`/`aud`/`exp`/`nbf` enforced.`Waffle\Commons\Auth\Authenticator\ApiKeyAuthenticator``X-Api-Key` — constant-time key matching.`Waffle\Commons\Auth\Authenticator\BasicAuthenticator``Authorization: Basic` — `password_verify()` / `hash_equals()`.`Waffle\Commons\Auth\Authenticator\AssertionAuthenticator`Inbound scheme wrapper around `AuthBridgeVerifier`.`Waffle\Commons\Auth\Oauth\OauthClient`Authorization-code + PKCE (S256) and client-credentials grants over any PSR-18 client.`Waffle\Commons\Auth\Oauth\OidcDiscovery``/.well-known/openid-configuration` resolution, PSR-16 cached.`Waffle\Commons\Auth\Client\AuthenticatedClient`PSR-18 decorator applying host-gated `CredentialsProviderInterface`s to outgoing requests.🔐 Security mandates (RFC-021 §5) -------------------------------- [](#-security-mandates-rfc-021-5) - Every MAC/secret comparison uses `hash_equals()` — constant time, zero exceptions. - **Fail-closed boot:** missing/empty/short (< 32 bytes) `WAFFLE_AUTH_SECRET` ⇒ `MissingAuthSecretException` aborts the kernel. - **Anti-replay:** assertions carry `iat`/`exp` with a strict ≤ 5 s window and a keyed client-IP hash (`iph`); OAuth `state`/`nonce` ride a signed, short-TTL cookie. - **Stateless:** no `$_SESSION`, no superglobals, no static state; the `SecurityContext`resets every worker loop; `igor-php` green. ✅ Quality gates --------------- [](#-quality-gates) ``` composer mago # fmt + lint + analyze + guard — zero baselines composer tests # PHPUnit 12, ≥ 95% coverage composer igor # zero state-mutation errors (FrankenPHP) ``` 📚 Documentation --------------- [](#-documentation) - RFC-021 — Universal Authentication Bridge (monorepo `project_system/RFCs/`). - Framework user docs: `documentation/how-to/authentication.md`, `documentation/reference/auth.md`, `documentation/explanation/authentication-universal-bridge.md`. ### Health Score 40 — FairBetter than 86% of packages Maintenance97 Actively maintained with recent releases Popularity4 Limited adoption so far Community10 Small or concentrated contributor base Maturity42 Maturing project, gaining track record Bus Factor1 Top contributor holds 100% of commits — single point of failure How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window. **Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores. **Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement. **Maturity (30%)** — Project age, version count, PHP version support, and release stability. ### Release Activity Cadence Every ~16 days Total 3 Last Release 16d ago ### Community Maintainers ![](https://www.gravatar.com/avatar/34a7557a3fb23aaf788ca3892b9b7efdf96e753264bafd0599153c9e8a921316?d=identicon)[LesliePetrimaux](/maintainers/LesliePetrimaux) --- Top Contributors [![supa-chayajin](https://avatars.githubusercontent.com/u/695448?v=4)](https://github.com/supa-chayajin "supa-chayajin (18 commits)") ### Code Quality TestsPHPUnit Static AnalysisPsalm Type Coverage Yes ### Embed Badge ![Health badge](/badges/waffle-commons-auth/health.svg) ``` [![Health](https://phpackages.com/badges/waffle-commons-auth/health.svg)](https://phpackages.com/packages/waffle-commons-auth) ``` ### Alternatives [flow-php/flow PHP ETL - Extract Transform Load - Data processing framework 85036.3k](/packages/flow-php-flow)[tempest/framework The PHP framework that gets out of your way. 2.2k34.4k16](/packages/tempest-framework)[cakephp/cakephp The CakePHP framework 8.8k19.5M1.8k](/packages/cakephp-cakephp)[typo3/cms TYPO3 CMS is a free open source Content Management Framework initially created by Kasper Skaarhoj and licensed under GNU/GPL. 1.2k1.9M122](/packages/typo3-cms)[typo3/cms-core TYPO3 CMS Core 3713.2M5.2k](/packages/typo3-cms-core)[shopware/core Shopware platform is the core for all Shopware ecommerce products. 585.6M600](/packages/shopware-core) PHPackages © 2026 [Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)