My name is Florent Morselli (flɔʁɑ̃ mɔʁseli). I am a French web developer and project manager passionate about PHP, ReactJS and Free, Libre & Open-Source Software. As far as possible, I contribute to projects or publish my own work.
🧡 Since early 2025, I am proud to be a
. This allows me to help shape the future of the framework I use and love daily.
The projects I am working on are mainly related to security over web applications. In particular, you will find useful libraries of Symfony bundles for
- One-Time Passwords (TOTP/HOTP) => see https://github.com/Spomky-Labs/otphp,
- Json Web Tokens (JWT, including signed and encrypted ones) => see https://github.com/web-token,
- Web Push => see https://github.com/Spomky-Labs/web-push,
- Concise Binary Object Representation (CBOR) => see https://github.com/Spomky-Labs/cbor-php,
- Webauthn => see https://github.com/web-auth.
Among all of these projects, let me encourage you to read more about Webauthn, a PHP implementation I am working on since end of 2018 and that will help you to get rid of passwords.
In addition, I had the opportunity to share my knowledge during the following events:
- September 2022: I presented the possibilities offered by this technology during the second edition of ApiPlatformCon in September 2022 in Lille, France.
- March 2023, I gave two 1-day workshops during the Symfony Live Paris 2023.
- December 2023, I gave a 1-day workshop during the Symfony Con Brussels 2023.
- March 2024, I presented my feedback on the Progressive Web Apps and gave a 1-day workshop during the Symfony Live 2024.
- March 2025, I gave a 1-day workshop during the Symfony Live 2025
Feel free to ask me about all of these FLOSS projects or reach me on any other topics you may want to discuss.
Hereafter an overview of my involvement in the Open-Source ecosystem. If you wish, you can sponsor me. The GitHub Sponsors page or the Patreon page are made for that purpose. Any help is greatly appreciated and allows me to spend time on these projects.
- Spomky-Labs/docs - The documentation of the open-source security libraries for PHP published by Slabs. (1 day ago)
- Spomky-Labs/meteofony - A community-driven weather application, written to demonstrate Symfony and not to be used. (1 day ago)
- web-token/jwt-framework - JSON Web Tokens: JWS, JWE and JWK. (1 day ago)
- web-token/jwt-selective-disclosure - Selective Disclosure for JWTs (SD-JWT, RFC 9901) of JWT Framework. (1 day ago)
- web-token/jwt-unsecured - The unsecured JWS algorithm, none, of JWT Framework, kept apart. (2 days ago)
- Spomky-Labs/otphp - TOTP and HOTP one-time passwords. (3 days ago)
- Spomky-Labs/access-control-framework - Authorization for PHP and Symfony: decides whether a requester may act on a subject. (4 days ago)
- Spomky-Labs/cbor-php - CBOR encoding and decoding. (4 days ago)
- Spomky-Labs/pki-framework - X.509 certificates, ASN.1 and public key infrastructure. (4 days ago)
- Spomky-Labs/pwa-bundle - Progressive web apps for Symfony: manifest, service worker and offline support. (4 days ago)
- docs(jwt): what else changes from 4.2 to 4.3, after a backward compatibility audit on Spomky-Labs/docs (today)
- fix(bundle): keep the service ids of the library "none" and "RSA1_5" classes, deprecated on web-token/jwt-framework (1 day ago)
- fix(key-management): JKUFactory and X5UFactory extend UrlKeySetFactory again on web-token/jwt-framework (1 day ago)
- fix(composer): require web-token/jwt-library ^4.3 in the bundle and experimental packages on web-token/jwt-framework (1 day ago)
- fix(json): bound the JSON documents decoded outside of a token on web-token/jwt-framework (1 day ago)
- docs(jwt): the bounds of the JSON decoder are named, for tokens and SD-JWTs on Spomky-Labs/docs (1 day ago)
- fix(serializers): chain the reason of the serializer a token belongs to on web-token/jwt-framework (1 day ago)
- fix(serializers): chain the bound a token goes beyond in the serializer managers on web-token/jwt-framework (1 day ago)
- fix(serializers): name the bound a token goes beyond when it is decoded on web-token/jwt-framework (1 day ago)
- fix(sd-jwt): refuse the unparsable unprotected headers as the other claims on web-token/jwt-framework (1 day ago)
- web-token/jwt-framework (4.2.7, 2 days ago) - JSON Web Tokens: JWS, JWE and JWK.
- Spomky-Labs/otphp (11.5.1, 3 days ago) - TOTP and HOTP one-time passwords.
- api-platform/core (v5.0.6, 4 days ago) - The server component of API Platform: hypermedia and GraphQL APIs in minutes
- symfony/symfony (v8.2.0-BETA1, 6 days ago) - The Symfony PHP framework
- symfony/azure-keyvault-key-management (v8.2.0-BETA1, 6 days ago) - Symfony Azure Key Vault Key Management Bridge
- symfony/flysystem-key-management (v8.2.0-BETA1, 6 days ago) - Symfony Flysystem Key Management Bridge
- symfony/doctrine-orm-key-management (v8.2.0-BETA1, 6 days ago) - Symfony Doctrine ORM Key Management Bridge
- symfony/security-core (v8.2.0-BETA1, 6 days ago) - Symfony Security Component - Core Library
- symfony/web-link (v8.2.0-BETA1, 6 days ago) - Manages links between resources
- symfony/console (v8.2.0-BETA1, 6 days ago) - Eases the creation of beautiful and testable command line interfaces
