Composer 2.4 encrypted auth.json lacks token scope metadata and automatic refresh

Question

ContextComposer 2.4 introduced encrypted auth.json storage, requiring a passphrase to decrypt credentials at runtime. This improves credential confidentiality but does not extend the underlying authentication model to support token scopes or automatic renewal.GoalDefine a least-privilege authentication workflow for private package repositories where tokens carry explicit scope restrictions and expire on a predictable schedule, while still using the encrypted auth.json format.Constraints and uncertaintyThe current auth.json schema stores tokens as opaque strings under http-basic or gitlab-token keys without scope identifiers. Composer does not inspect token expiry claims, nor does it trigger a refresh flow when a 401 response is received. Expired or over-scoped tokens therefore remain in the file until manually removed, and failed installations surface only generic authentication errors.Documentation confirms the encryption feature but does not describe a roadmap for scope-aware storage or built-in token lifecycle management.QuestionsIs there a supported extension point or plugin interface that allows injecting scope validation and automatic token refresh into Composer's authentication layer without modifying core code?What is the recommended pattern for rotating short-lived, scope-limited tokens in CI/CD pipelines that rely on encrypted auth.json?

Tasadduq Burney · Answer

AnswerComposer 2.4 does not provide a supported extension point for intercepting token decryption, validating scopes, or triggering an automatic refresh. The plugin system can listen to command events, but token handling occurs inside the core RemoteFilesystem before any HTTP request, so a plugin cannot replace or augment that process without wrapping the downloader.Confirmed factsThe encrypted auth.json format stores tokens as opaque strings under keys such as http-basic or gitlab-token.Composer does not parse JWT claims, inspect expiry, or scope metadata, and it does not retry on 401 responses.Composer’s PluginInterface exists, but there is no dedicated authentication‑refresh hook; plugins only receive generic command events.Recommended CI/CD patternGenerate a short‑lived, scope‑limited token from your private registry (e.g., GitLab CI job token, Artifactory API key).Create a plain auth.json file containing that token under the appropriate key.Encrypt the file with a passphrase that is stored as a secret in your CI system (e.g., COMPOSER_AUTH or config‑auth).Expose the encrypted blob to Composer via the environment variable or config setting before running composer install or composer update.Regenerate the encrypted file for each pipeline run or shortly before the token expires; discard the previous encrypted blob.If you need to validate scopes or renew tokens automatically, you must handle those steps outside Composer (e.g., a wrapper script that refreshes the token, re‑encrypts auth.json, and retries the Composer command).

Composer 2.4 encrypted auth.json lacks token scope metadata and automatic refresh

Context

Goal

Constraints and uncertainty

Questions

1 answer

Answer

Confirmed facts

Recommended CI/CD pattern

Your perspective belongs here.

0 question comments