Skip to content

[Docs] Missing GMP/BCMath requirement warning for web-token/jwt-library #21685

@guillaumebeausse-dev

Description

@guillaumebeausse-dev

The Symfony documentation recommends installing web-token/jwt-library without warning that the GMP or BCMath PHP extension is required for acceptable performance.

composer require web-token/jwt-library symfony/cache

Without these extensions, the library falls back to brick/math's pure PHP implementation for big integer operations, resulting in extremely slow RSA signature verification.

Benchmark results (RSA-256, 2048-bit key)

PHP Extension JWT verification time Relative performance
None (pure PHP) ~1,568 ms 780x slower
BCMath ~10 ms 5x slower
GMP ~2 ms baseline

Impact

  • API response times of 1.5+ seconds per authenticated request
  • Timeouts on high-traffic applications
  • Difficult to diagnose (no error, just slow performance)

Root cause

  1. web-token/jwt-library depends on brick/math
  2. brick/math silently falls back to pure PHP when GMP/BCMath are unavailable
  3. The [web-token documentation](https://web-token.spomky-labs.com/introduction/pre-requisite) mentions this requirement, but the Symfony docs do not

Suggested fix

Add a note to the documentation recommending GMP installation:

> **Performance Warning:** For production use, ensure the GMP PHP extension is installed. 
> Without it, JWT verification can be up to 780x slower.

References

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions