quioteframework/auth

Authentication foundation (form login, HTTP Basic, password hashing, user providers, firewalls) for Quiote.

v3.1.0 2026-07-29 21:44 UTC

Requires

• php: >=8.5.0
• quioteframework/quiote: *

Suggests

• quioteframework/csrf: Adds CSRF-token verification to FormLoginAuthenticator.
• quioteframework/ratelimit: Adds LoginThrottle-based brute-force throttling to FormLoginAuthenticator.

MIT

• Quiote Contributors

• security
• Authentication
• auth
• quiote

Published on Packagist.org on 2026-07-29 22:10 UTC

README

Authentication foundation for Quiote: password hashing, user providers, HTTP Basic and form-login authenticators, firewalls, and the AuthenticationManager/AuthenticationMiddleware pipeline plumbing. Generalizes to any credential mechanism via Quiote\Security\Auth\AuthenticatorInterface; see quioteframework/auth-jwt (bearer/JWT) and quioteframework/auth-oauth (OIDC + Client Credentials) for token-based mechanisms.

Install

composer require quioteframework/auth

Enable

Register Quiote\Security\Auth\AuthPlugin in your app's plugins.* config (or via PluginManager::add()). Installing it alone changes nothing: the default FirewallMap has zero firewalls, so both authentication middleware are a no-op until you register your own FirewallMap as an earlier DI service — either by hand, or from a security.xml file via Quiote\Security\Auth\Config\SecurityConfigHandler + FirewallFactory.

Soft dependencies

• quioteframework/csrf — pass a CsrfManager to FormLoginAuthenticator to verify a CSRF token on login.
• quioteframework/ratelimit — pass a LoginThrottle to FormLoginAuthenticator to throttle repeated failures.

License

MIT. See LICENSE.