Download the PHP package php-websocket-rpc/rpc-server without Composer

php-websocket-rpc/rpc-server

Async RPC server over WebSocket using amphp and msgpack.

Install

Requires PHP 8.5+, ext-msgpack, and the amphp ecosystem.

Quick Start

The client then uses createProxy():

Features

• Contract services — register interface implementations, auto-dispatched via ContractRegistry
• Streaming — methods returning Iterator are automatically streamed to the client
• Subscribe/Publish — #[RpcSubscribe] and #[RpcPublish] attributes on interface methods
• Authentication — useAuthentication() with pluggable providers, #[NeedAuthorization] attribute
• Middleware — pipeline for rate limiting, logging, auth, etc.
• Client sessions — track connected clients with per-session attributes

Authentication & Authorization

You must implement AuthenticationProvider to validate tokens and AuthorizationProvider to authorize method calls. The framework provides built-in implementations for testing. The AuthService is automatically registered and can be used to authenticate clients. The ClientSessionContext is a fiber-safe accessor for session attributes.

Quick Setup

Protecting Methods

Use the #[NeedAuthorization] attribute on your contract interface:

Client Flow

Custom Authentication Provider

Implement AuthenticationProvider to use JWT, database, or any other logic:

Custom Authorization Provider

For fine-grained authorization (resource ownership, IP checks, etc.):

Statelessness

The AuthenticationProvider::validateToken() method must be stateless for cross-replica deployments. Use JWT (self-contained) or look up from a shared store (Redis/DB). It returns a Token value object (id, issuer, subject, audience, expiry) — the actual user data is resolved separately via UserProvider::getUser(). The framework only stores the authenticated user per-WebSocket-connection in memory, which is freed on disconnect.

Contract Services

Define an interface with attributes:

Register the implementation:

Architecture

The server uses a builder + adapter pattern to keep the core framework-agnostic:

• RpcServerBuilder collects all configuration (services, middleware, auth) and calls build() to produce a configured RpcServer
• RpcServer is the runtime: dispatches messages, manages sessions, and streams — it has zero amphp imports in its core
• AmpWebSocketServerAdapter bridges amphp's HTTP/WebSocket layer to RpcServer, creating ClientSession on upgrade and wrapping the amp client in Client (from PhpWebsocketRpc\Rpc\Transport\Amp)
• Transport interfaces (WebSocketClientInterface, MessageInterface, TlsInfoInterface) in PhpWebsocketRpc\Rpc\Transport define the boundary; amp implementations live in a sub-namespace

Key Classes