Download the PHP package padosoft/laravel-rebel-sessions without Composer
On this page you can find all versions of the php package padosoft/laravel-rebel-sessions. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.
Download padosoft/laravel-rebel-sessions
More information about padosoft/laravel-rebel-sessions
Files in padosoft/laravel-rebel-sessions
Package laravel-rebel-sessions
Short Description Device/session registry for Laravel Rebel: session/device tracking, logout-everywhere, refresh-token rotation with reuse detection, and device trust. Part of padosoft/laravel-rebel-*.
License MIT
Homepage https://github.com/padosoft/laravel-rebel-sessions
FAQ
Example:
In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
- Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
- To use Composer is sometimes complicated. Especially for beginners.
- Composer needs much resources. Sometimes they are not available on a simple webspace.
- If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
- Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Informations about the package laravel-rebel-sessions
Laravel Rebel — Sessions
Official documentation: https://doc.laravel-rebel.padosoft.com
Refresh-token rotation with reuse detection, logout-everywhere, and device trust. When a stolen refresh token is replayed, Rebel detects the reuse and burns the whole session — every token of that user — instead of silently handing the attacker a fresh one. Plus remembered-device trust to cut step-up friction. Part of the
padosoft/laravel-rebel-*suite.
Table of contents
- What it is
- Quick glossary
- Why this package
- Rebel Sessions vs the alternatives
- How rotation + reuse detection works
- Installation
- Usage
- Security notes
- Testing & License
What it is
The device/session registry for Rebel. It provides the default implementations of two
core contracts — SessionRegistry (used by OTP/step-up for logout-everywhere and reuse
checks) and DeviceTrust (remembered devices) — plus a SessionManager that does the real
work: tracking sessions/refresh tokens and rotating them safely.
Depends on padosoft/laravel-rebel-core.
Quick glossary
| Term | In plain words |
|---|---|
| Refresh token | A long-lived token exchanged for a fresh access token (e.g. on mobile). |
| Rotation | Each use of a refresh token consumes it and issues a brand-new one. |
| Reuse detection | If an already-used refresh token shows up again, it was probably stolen → react. |
| Chain | All the refresh tokens descended from one original login, sharing a root_id. |
| Device trust | "Remember this device" so it can skip step-up for a while. |
Why this package
| ★ | What | In short |
|---|---|---|
| ★★★ | Reuse detection that burns the chain | A replayed refresh token doesn't just fail — it revokes all the user's tokens (the correct theft response). |
| ★★★ | Ownership + expiry enforced | A refresh token can only be rotated by its owner, and never after it expires. |
| ★★★ | Race-safe rotation | Every rotation locks the chain root, so concurrent requests serialize and no sibling escapes a burn. |
| ★★ | Logout-everywhere | One call revokes every active session/token of a subject. |
| ★★ | Device trust | Remembered devices (by fingerprint hash) expire after N days; atomic, tenant-scoped. |
| ★★ | Drop-in contracts | Implements the core SessionRegistry + DeviceTrust — OTP/step-up use them automatically. |
Rebel Sessions vs the alternatives
| Capability | Rebel Sessions | Shopify | Sanctum / Passport (native) | Hand-rolled |
|---|---|---|---|---|
| Refresh-token rotation you control | ✅ | ❌ | ➖ (Passport rotates, Sanctum has no refresh) | ❌ |
| Reuse detection (theft signal) | ✅ | ❌ | ❌ | ❌ |
| Burns the whole chain/user on reuse | ✅ | ❌ | ❌ | ❌ |
| Owner + expiry enforced on rotate | ✅ | ➖ | ➖ | ❌ |
| Race-safe (chain-root locking) | ✅ | ❌ | ❌ | ❌ |
| Programmatic logout-everywhere API | ✅ | ➖ | ➖ | ➖ |
| Customer-facing login activity / logout | ✅ | ✅ | ❌ | ❌ |
| Remembered-device trust API | ✅ | ➖ | ❌ | ❌ |
| Multi-tenant + audit-friendly (your app) | ✅ | ❌ | ❌ | ❌ |
Legend: ✅ built-in · ➖ partial / hosted-only / not exposed to you · ❌ not available.
Note: Shopify is a hosted, closed commerce platform — it manages its own customer sessions and shows shoppers a "logged-in devices" view, but never exposes refresh-token rotation, reuse detection, or a device-trust API you can self-host or build on.
How rotation + reuse detection works
A rotation can only proceed if the token is active, owned by the caller, and not expired — otherwise it returns null (and, for reuse, burns the user's tokens).
Installation
The package binds the core SessionRegistry and DeviceTrust contracts automatically.
Usage
Device trust:
Security notes
- Reuse = theft: a replayed refresh token revokes every live token of the subject.
- Ownership & expiry: rotation checks the token belongs to the caller and isn't expired.
- Race-safe: rotations lock the chain root row, so concurrent rotations serialize.
- UUID ids; tenant-scoped queries; device fingerprints stored as hashes (never raw).
🔋 Vibe coding with batteries included
This package ships AI batteries — so you (and your AI agent) can extend it correctly on the first try:
CLAUDE.md— a concise AI working guide (purpose, conventions, architecture, how to extend, Definition of Done). Plain Markdown, so Claude Code, Cursor, Copilot and Codex all read it.AGENTS.md— the agent/workflow contract (branch → PR → CI → tag/release, the gates)..claude/skills/— invocable skills (at leastrebel-package-dev) encoding the suite's TDD loop, the PHPStan-level-max recipes, the security/telemetry rules, and the release discipline.
Open the repo in your AI editor and just start — the rules, guardrails and extension recipes come
with it. PRs that follow the shipped CLAUDE.md pass CI (PHPStan max + Pest + Pint) and review the
first time around.
Testing & License
License: MIT — see padosoft/laravel-rebel suite.
All versions of laravel-rebel-sessions with dependencies
illuminate/contracts Version ^12.0|^13.0
illuminate/support Version ^12.0|^13.0
spatie/laravel-package-tools Version ^1.92
padosoft/laravel-rebel-core Version ^0.1