Download the PHP package waffle-commons/auth without Composer
On this page you can find all versions of the php package waffle-commons/auth. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.
Table of contents
Download waffle-commons/auth
More information about waffle-commons/auth
Files in waffle-commons/auth
Download waffle-commons/auth
More information about waffle-commons/auth
Files in waffle-commons/auth
Vendor waffle-commons
Package auth
Short Description Auth component for Waffle framework.
License MIT
Package auth
Short Description Auth component for Waffle framework.
License MIT
FAQ
After the download, you have to make one include require_once('vendor/autoload.php');. After that you have to import the classes with use statements.
Example:
Example:
If you use only one package a project is not needed. But if you use more then one package, without a project it is not possible to import the classes with use statements.
In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
Some PHP packages are not free to download and because of that hosted in private repositories.
In this case some credentials are needed to access such packages.
Please use the auth.json textarea to insert credentials, if a package is coming from a private repository.
You can look here for more information.
- Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
- To use Composer is sometimes complicated. Especially for beginners.
- Composer needs much resources. Sometimes they are not available on a simple webspace.
- If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
- Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Please rate this library. Is it a good library?
Informations about the package auth
Waffle Auth Component
Release:
0.1.0-beta5|CHANGELOG.md
The Universal Authentication Bridge (UAB, RFC-021): Waffle's entire authentication layer. Connect a Waffle application to popular authentication services without technical debt — natively, statelessly, fail-closed — in both directions:
- Inbound — interchangeable authenticators for OAuth2/OIDC providers (Google, Microsoft, Keycloak, Auth0, …), JWT bearer tokens (HS256/RS256 + JWKS), HMAC-signed gateway assertions, API keys, and HTTP Basic.
- Outbound — a host-gated PSR-18
AuthenticatedClientdecorator that attaches credentials (signed assertion, Bearer token, API key, Basic) to outgoing requests.
Authentication only: who are you? Authorization (may you do this?) remains in
waffle-commons/security (RFC-002 ABAC).
📦 Installation
🧱 Surface
| Class | Role |
|---|---|
Waffle\Commons\Auth\SecurityContext |
Request-scoped identity holder. Implements ResettableInterface — wiped between FrankenPHP worker loops (zero-leak). |
Waffle\Commons\Auth\AuthenticationBridge |
Orchestrator: runs registered authenticators in order; first supports() wins; rejection throws (fail-closed); none ⇒ anonymous. |
Waffle\Commons\Auth\Middleware\AuthenticationMiddleware |
PSR-15 entry point: bridge + SecurityContext + _auth_identity request attribute. |
Waffle\Commons\Auth\Middleware\GatewayAssertionMiddleware |
Downstream PSR-15 middleware verifying X-Wfl-Assert-User (signature, expiry, IP-binding) and hydrating the context. |
Waffle\Commons\Auth\Uab\UserAssertion |
Immutable assertion VO (PHP 8.5 hooks + asymmetric visibility): usr, eml, rol, ten, iat, exp, iph. |
Waffle\Commons\Auth\Uab\AuthBridgeSigner |
Signs assertions: base64url(payload).hex(HMAC-SHA256) with WAFFLE_AUTH_SECRET. Fail-closed boot (≥ 32-byte secret). |
Waffle\Commons\Auth\Uab\AuthBridgeVerifier |
Verifies assertions: hash_equals() MAC check, exp/iat window (≤ 5 s), keyed IP-hash binding. |
Waffle\Commons\Auth\Authenticator\JwtAuthenticator |
Authorization: Bearer — HS256/RS256, strict alg allow-list, alg:none rejected, iss/aud/exp/nbf enforced. |
Waffle\Commons\Auth\Authenticator\ApiKeyAuthenticator |
X-Api-Key — constant-time key matching. |
Waffle\Commons\Auth\Authenticator\BasicAuthenticator |
Authorization: Basic — password_verify() / hash_equals(). |
Waffle\Commons\Auth\Authenticator\AssertionAuthenticator |
Inbound scheme wrapper around AuthBridgeVerifier. |
Waffle\Commons\Auth\Oauth\OauthClient |
Authorization-code + PKCE (S256) and client-credentials grants over any PSR-18 client. |
Waffle\Commons\Auth\Oauth\OidcDiscovery |
/.well-known/openid-configuration resolution, PSR-16 cached. |
Waffle\Commons\Auth\Client\AuthenticatedClient |
PSR-18 decorator applying host-gated CredentialsProviderInterfaces to outgoing requests. |
🔐 Security mandates (RFC-021 §5)
- Every MAC/secret comparison uses
hash_equals()— constant time, zero exceptions. - Fail-closed boot: missing/empty/short (< 32 bytes)
WAFFLE_AUTH_SECRET⇒MissingAuthSecretExceptionaborts the kernel. - Anti-replay: assertions carry
iat/expwith a strict ≤ 5 s window and a keyed client-IP hash (iph); OAuthstate/nonceride a signed, short-TTL cookie. - Stateless: no
$_SESSION, no superglobals, no static state; theSecurityContextresets every worker loop;igor-phpgreen.
✅ Quality gates
📚 Documentation
- RFC-021 — Universal Authentication Bridge (monorepo
project_system/RFCs/). - Framework user docs:
documentation/how-to/authentication.md,documentation/reference/auth.md,documentation/explanation/authentication-universal-bridge.md.
All versions of auth with dependencies
PHP Build Version
Package Version
Requires
php Version
^8.5
ext-openssl Version *
psr/http-client Version ^1.0
psr/http-factory Version ^1.0
psr/http-message Version ^1.1 || ^2.0
psr/http-server-handler Version ^1.0
psr/http-server-middleware Version ^1.0
psr/log Version ^3.0
psr/simple-cache Version ^3.0
waffle-commons/contracts Version self.version
web-auth/webauthn-lib Version ^5.3
symfony/serializer Version ^8.1
symfony/uid Version ^8.1
ext-openssl Version *
psr/http-client Version ^1.0
psr/http-factory Version ^1.0
psr/http-message Version ^1.1 || ^2.0
psr/http-server-handler Version ^1.0
psr/http-server-middleware Version ^1.0
psr/log Version ^3.0
psr/simple-cache Version ^3.0
waffle-commons/contracts Version self.version
web-auth/webauthn-lib Version ^5.3
symfony/serializer Version ^8.1
symfony/uid Version ^8.1
The package waffle-commons/auth contains the following files
Loading the files please wait ...