Download the PHP package hadefication/simple-token-auth without Composer

Simple Token Auth

A lightweight, secure, and easy-to-use authentication package for server-to-server communication in Laravel applications. This package provides simple token-based authentication with built-in security features like rate limiting, timing attack protection, and comprehensive logging.

Features

• 🔐 Secure Token Validation: Uses hash_equals() to prevent timing attacks
• 🚀 Multiple Service Support: Named tokens for different services with fallback support
• 🛡️ Rate Limiting: Built-in protection against brute-force attacks
• 📝 Comprehensive Logging: Failed authentication attempts with IP and endpoint tracking
• 🔧 Developer Tools: CLI commands for token generation and configuration inspection
• 🎯 Flexible Headers: Supports both Authorization: Bearer and X-API-Token headers
• 🔒 Token Masking: Secure token masking in logs and debug outputs

Installation

You can install the package via Composer:

The package will automatically register its service provider and configuration.

Configuration

Publishing Configuration

Publish the configuration file to customize the package settings:

Environment Variables

Add the following to your .env file:

Configuration File

The config/simple-token-auth.php file contains all configuration options:

Usage

Basic Middleware Usage

Apply the middleware to your routes:

Service-Specific Authentication

Authenticate with a specific service token:

Accessing Service Context

When using service-specific authentication, you can access the authenticated service:

Token Headers

The package supports two header formats:

Developer Tools

Generate Tokens

Generate cryptographically secure tokens:

Example output:

With --save flag:

Adding Generated Tokens to Configuration

After generating a token, you need to manually add it to your configuration:

1. Add to .env file

Copy the generated token and add it to your .env file:

2. Update config file (optional)

If you want to reference the token in your config/simple-token-auth.php file:

3. Clear configuration cache

After updating the configuration, clear the cache:

4. Verify the token

Use the info command to verify your token is properly configured:

Inspect Configuration

View your current token configuration:

Example output:

Security Features

Timing Attack Protection

All token comparisons use hash_equals() to prevent timing attacks, ensuring that comparing valid and invalid tokens takes the same amount of time.

Rate Limiting

The package implements rate limiting to protect against brute-force attacks:

• Configurable Limits: Set maximum attempts and lockout duration
• IP-based Tracking: Uses hashed IP addresses to protect privacy
• Automatic Reset: Rate limits are cleared on successful authentication

Token Masking

Tokens are automatically masked in logs and debug outputs:

• Log Security: Failed authentication attempts log IP and endpoint without exposing tokens
• Debug Safety: Configuration inspection shows masked tokens only

Comprehensive Logging

Failed authentication attempts are logged with:

• IP address of the requester
• Full URL that was accessed
• Timestamp of the attempt

Error Responses

The package returns standardized JSON error responses:

Unauthorized (401)

Too Many Requests (429)

Testing

The package includes comprehensive tests covering:

• Token validation and generation
• Middleware functionality
• Rate limiting behavior
• Security features (timing attacks, token masking)
• Command-line tools

Run the test suite:

Contributing

Please see CONTRIBUTING.md for details.

Security

If you discover any security-related issues, please email [email protected] instead of using the issue tracker.

License

The MIT License (MIT). Please see License File for more information.