-
-
Notifications
You must be signed in to change notification settings - Fork 5.3k
Open
Description
The Symfony documentation recommends installing web-token/jwt-library without warning that the GMP or BCMath PHP extension is required for acceptable performance.
composer require web-token/jwt-library symfony/cacheWithout these extensions, the library falls back to brick/math's pure PHP implementation for big integer operations, resulting in extremely slow RSA signature verification.
Benchmark results (RSA-256, 2048-bit key)
| PHP Extension | JWT verification time | Relative performance |
|---|---|---|
| None (pure PHP) | ~1,568 ms | 780x slower |
| BCMath | ~10 ms | 5x slower |
| GMP | ~2 ms | baseline |
Impact
- API response times of 1.5+ seconds per authenticated request
- Timeouts on high-traffic applications
- Difficult to diagnose (no error, just slow performance)
Root cause
web-token/jwt-librarydepends onbrick/mathbrick/mathsilently falls back to pure PHP when GMP/BCMath are unavailable- The [web-token documentation](https://web-token.spomky-labs.com/introduction/pre-requisite) mentions this requirement, but the Symfony docs do not
Suggested fix
Add a note to the documentation recommending GMP installation:
> **Performance Warning:** For production use, ensure the GMP PHP extension is installed.
> Without it, JWT verification can be up to 780x slower.References
Metadata
Metadata
Assignees
Labels
No labels