Download the PHP package sengheat/laravel-sso without Composer

On this page you can find all versions of the php package sengheat/laravel-sso. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.

FAQ

After the download, you have to make one include require_once('vendor/autoload.php');. After that you have to import the classes with use statements.

Example:
If you use only one package a project is not needed. But if you use more then one package, without a project it is not possible to import the classes with use statements.

In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
Some PHP packages are not free to download and because of that hosted in private repositories. In this case some credentials are needed to access such packages. Please use the auth.json textarea to insert credentials, if a package is coming from a private repository. You can look here for more information.

  • Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
  • To use Composer is sometimes complicated. Especially for beginners.
  • Composer needs much resources. Sometimes they are not available on a simple webspace.
  • If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
  • Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Please rate this library. Is it a good library?

Example code of sengheat/laravel-sso

Informations about the package laravel-sso

sengheat/sso-token

A Laravel SSO package — one central auth-service issues tokens, every other service verifies them without HTTP calls.

How It Works

Installation

Part 1 — Auth Service (Issuer)

The service that owns the users table and issues tokens.

1. Enable issuer mode in .env

2. Publish and configure config/sso.php

3. Add HasSSOProfile trait to User model

4. Add api guard to config/auth.php

5. Run migration

Adds to users table: sso_provider, sso_provider_id, sso_token, sso_avatar, api_token (indexed).

Available routes (auto-registered)

Method URI Description
GET /sso/login Login page (form)
POST /sso/login Process login
GET /sso/register Register page
POST /sso/register Process register
POST /api/sso/login API login → {user, token}
POST /api/sso/register API register → {user, token}
POST /api/sso/exchange Exchange one-time code → {user, token}
POST /api/sso/logout Revoke token
GET /api/sso/user Current user info

Part 2 — Other Services (Consumers)

Order service, product service, any service that needs to verify tokens.

1. Install package

2. Add auth_db connection to config/database.php

3. Add sso guard to config/auth.php

4. User model — points to auth_db

5. Register middleware in bootstrap/app.php

6. Protect routes

7. .env

How token verification works

PostgreSQL security (production)

Part 3 — Web Portal (Next.js / React)

Token is never visible in the URL. A 30-second one-time code is used instead.

Flow

Step 1 — Redirect to auth-service

Step 2 — Callback page (/sso/callback)

Step 3 — Use token on any service

.env.local

Part 4 — Mobile App (React Native / Flutter)

Mobile calls the API endpoints directly — no browser redirect needed.

Login

Store token securely (iOS Keychain / Android Keystore).

Use token on any service

Logout

React Native

Flutter

Trait Helpers

Security Summary

Concern Solution
Token in URL One-time code exchange — token never in URL
Token storage SHA256 hash in DB — plain token only in HTTP response
Open redirect SSO_ALLOWED_REDIRECTS whitelist
DB access Dedicated read-only PostgreSQL user per service
Network pg_hba.conf IP whitelist on auth_db port
Brute force throttle:20,1 on login routes
Cache Redis with TTL — stale tokens auto-expire

Environment Variables Reference

Variable Service Default Description
SSO_FORM_AUTH Issuer false Enable built-in login/register
SSO_FORM_AUTH_REGISTER Issuer true Allow new registrations
SSO_ALLOWED_REDIRECTS Issuer — Comma-separated portal callback URLs
SSO_REDIRECT_AFTER_LOGIN Issuer /dashboard Fallback redirect after login
SSO_REDIRECT_AFTER_LOGOUT Issuer /sso/login Redirect after logout
SSO_CACHE_STORE Consumer null (default) Cache driver: redis, file
SSO_TOKEN_CACHE_TTL Consumer 300 Token cache TTL in seconds
AUTH_DB_HOST Consumer 127.0.0.1 Auth-service DB host
AUTH_DB_PORT Consumer 5432 Auth-service DB port
AUTH_DB_DATABASE Consumer auth_service Auth-service DB name
AUTH_DB_USERNAME Consumer — Read-only DB user
AUTH_DB_PASSWORD Consumer — DB password

License

MIT — Seng Heat

All versions of laravel-sso with dependencies

PHP Build Version
Package Version
Requires php Version ^8.1
illuminate/support Version ^10.0|^11.0|^12.0|^13.0
laravel/socialite Version ^5.0
Composer command for our command line client (download client) This client runs in each environment. You don't need a specific PHP version etc. The first 20 API calls are free. Standard composer command

The package sengheat/laravel-sso contains the following files

Loading the files please wait ...