My name is Florent Morselli (flɔʁɑ̃ mɔʁseli). I am a French web developer and project manager passionate about PHP, ReactJS and Free, Libre & Open-Source Software. As far as possible, I contribute to projects or publish my own work.

🧡 Since early 2025, I am proud to be a . This allows me to help shape the future of the framework I use and love daily.

The projects I am working on are mainly related to security over web applications. In particular, you will find useful libraries of Symfony bundles for

• One-Time Passwords (TOTP/HOTP) => see https://github.com/Spomky-Labs/otphp,
• Json Web Tokens (JWT, including signed and encrypted ones) => see https://github.com/web-token,
• Web Push => see https://github.com/Spomky-Labs/web-push,
• Concise Binary Object Representation (CBOR) => see https://github.com/Spomky-Labs/cbor-php,
• Webauthn => see https://github.com/web-auth.

Among all of these projects, let me encourage you to read more about Webauthn, a PHP implementation I am working on since end of 2018 and that will help you to get rid of passwords.

In addition, I had the opportunity to share my knowledge during the following events:

• September 2022: I presented the possibilities offered by this technology during the second edition of ApiPlatformCon in September 2022 in Lille, France.
• March 2023, I gave two 1-day workshops during the Symfony Live Paris 2023.
• December 2023, I gave a 1-day workshop during the Symfony Con Brussels 2023.
• March 2024, I presented my feedback on the Progressive Web Apps and gave a 1-day workshop during the Symfony Live 2024.
• March 2025, I gave a 1-day workshop during the Symfony Live 2025

Feel free to ask me about all of these FLOSS projects or reach me on any other topics you may want to discuss.

Hereafter an overview of my involvement in the Open-Source ecosystem. If you wish, you can sponsor me. The GitHub Sponsors page or the Patreon page are made for that purpose. Any help is greatly appreciated and allows me to spend time on these projects.

• web-token/jwt-doc - Documentation for the JWT Framework (today)
• web-token/jwt-framework - JWT Framework (today)
• Spomky-Labs/access-control-framework - Authorization for PHP and Symfony: decides whether a requester is allowed to perform an action on a subject. (1 day ago)
• Spomky-Labs/cbor-bundle - CBOR Encoder/Decoder Bundle for Symfony (1 day ago)
• Spomky-Labs/cbor-php - CBOR Encoder/Decoder for PHP (1 day ago)
• Spomky-Labs/dbsc-bundle - Device Bound Session Credentials (DBSC) for Symfony: protect sessions from cookie theft with hardware-bound keys. (1 day ago)
• Spomky-Labs/otphp - 🔐 A PHP library for generating one time passwords according to RFC 4226 (HOTP) and the RFC 6238 (TOTP) (1 day ago)
• Spomky-Labs/phpwa-demo - Demonstration for the PHPWA Bundle (1 day ago)
• Spomky-Labs/pki-framework - Public Key Infrastructure (1 day ago)
• Spomky-Labs/pwa-bundle - PHP library for generating a full featured PWA manifest (1 day ago)

• feat(checker): announce the object replacing the token type support headers on web-token/jwt-framework (today)
• feat(core): announce the 5.0.0 breaks that were still silent on web-token/jwt-framework (today)
• feat(algorithms): ship "none" and RSA1_5 in their own packages on web-token/jwt-framework (today)
• feat(core): typed accessors on the JWK, sealed helpers on the JWKSet on web-token/jwt-framework (today)
• feat(key-mgmt): make the key factory an injectable service on web-token/jwt-framework (today)
• feat(core): seal the internal mutators of the JWS and the JWE on web-token/jwt-framework (today)
• feat(key-management): free JKUFactory and X5UFactory from a deprecated base on web-token/jwt-framework (today)
• feat(core): introduce interfaces for the main services on web-token/jwt-framework (1 day ago)
• feat(core): return result objects instead of by-reference output parameters on web-token/jwt-framework (1 day ago)
• feat(core): introduce a JOSE exception hierarchy on web-token/jwt-framework (1 day ago)

• web-token/jwt-framework (4.2.1, 1 day ago) - JWT Framework
• web-auth/cose-lib (4.7.0, 1 day ago) - Cose Key and Algorithms support
• web-auth/webauthn-framework (5.3.6, 1 day ago) - FIDO-U2F / FIDO2 / Webauthn Framework
• Spomky-Labs/cbor-php (3.3.1, 1 day ago) - CBOR Encoder/Decoder for PHP
• symfony/symfony (v8.1.5, 1 week ago) - The Symfony PHP framework
• symfony/security-core (v8.1.5, 1 week ago) - Symfony Security Component - Core Library
• symfony/validator (v8.1.5, 1 week ago) - Provides tools to validate values
• symfony/web-profiler-bundle (v8.1.5, 1 week ago) - Provides a development tool that gives detailed information about the execution of any request
• symfony/framework-bundle (v8.1.5, 1 week ago) - Provides a tight integration between Symfony components and the Symfony full-stack framework
• symfony/console (v8.1.5, 1 week ago) - Eases the creation of beautiful and testable command line interfaces

• tacman (2 years ago)
• yousign (3 years ago)
• passbolt (5 years ago)