My name is Florent Morselli (flɔʁɑ̃ mɔʁseli). I am a French web developer and project manager passionate about PHP, ReactJS and Free, Libre & Open-Source Software. As far as possible, I contribute to projects or publish my own work.
🧡 Since early 2025, I am proud to be a
. This allows me to help shape the future of the framework I use and love daily.
The projects I am working on are mainly related to security over web applications. In particular, you will find useful libraries of Symfony bundles for
- One-Time Passwords (TOTP/HOTP) => see https://github.com/Spomky-Labs/otphp,
- Json Web Tokens (JWT, including signed and encrypted ones) => see https://github.com/web-token,
- Web Push => see https://github.com/Spomky-Labs/web-push,
- Concise Binary Object Representation (CBOR) => see https://github.com/Spomky-Labs/cbor-php,
- Webauthn => see https://github.com/web-auth.
Among all of these projects, let me encourage you to read more about Webauthn, a PHP implementation I am working on since end of 2018 and that will help you to get rid of passwords.
In addition, I had the opportunity to share my knowledge during the following events:
- September 2022: I presented the possibilities offered by this technology during the second edition of ApiPlatformCon in September 2022 in Lille, France.
- March 2023, I gave two 1-day workshops during the Symfony Live Paris 2023.
- December 2023, I gave a 1-day workshop during the Symfony Con Brussels 2023.
- March 2024, I presented my feedback on the Progressive Web Apps and gave a 1-day workshop during the Symfony Live 2024.
- March 2025, I gave a 1-day workshop during the Symfony Live 2025
Feel free to ask me about all of these FLOSS projects or reach me on any other topics you may want to discuss.
Hereafter an overview of my involvement in the Open-Source ecosystem. If you wish, you can sponsor me. The GitHub Sponsors page or the Patreon page are made for that purpose. Any help is greatly appreciated and allows me to spend time on these projects.
- beffroi-auth/docs - Documentation of Beffroi, an identity provider for the Symfony ecosystem: the application that is the provider, and the identity core, OAuth 2.0 and OpenID Connect, and SAML 2.0 it is built on. A static site on GitHub Pages, one branch per version. (1 day ago)
- web-auth/doc - Documentation of WebAuthn Framework. (1 day ago)
- web-auth/webauthn-framework - WebAuthn and passkeys for PHP and Symfony. (1 day ago)
- Spomky-Labs/cbor-php - CBOR encoding and decoding. (4 days ago)
- Spomky-Labs/otphp - TOTP and HOTP one-time passwords. (4 days ago)
- Spomky-Labs/pki-framework - X.509 certificates, ASN.1 and public key infrastructure. (4 days ago)
- web-auth/cose-lib - COSE signing, encryption and key management. (4 days ago)
- web-token/jwt-framework - JSON Web Tokens: JWS, JWE and JWK. (4 days ago)
- web-token/jwt-selective-disclosure - Selective Disclosure for JWTs (SD-JWT, RFC 9901) of JWT Framework. (4 days ago)
- symfony/aws-key-management - Symfony AWS Key Management Bridge (1 week ago)
- The provider is one application, and the pages of its integration are pages of the application on beffroi-auth/docs (1 day ago)
- A refusal of UserInfo is challenged under the scheme the token was presented under, and every challenge under DPoP names the algorithms a proof may be signed with on beffroi-auth/docs (1 day ago)
- fix(tpm): verify a TPM attestation signed with SHA-1 when the application asks for it on web-auth/webauthn-framework (1 day ago)
- fix(client-data): bind the client data type to the ceremony on web-auth/webauthn-framework (1 day ago)
- fix(denormalizer): reject a public key credential whose type is not public-key on web-auth/webauthn-framework (1 day ago)
- ci: remove the OpenSSF Scorecard workflow on web-auth/webauthn-framework (1 day ago)
- fix(denormalizer): decode authenticatorData, signature and userHandle as base64url only on web-auth/webauthn-framework (1 day ago)
- fix(client-data): refuse a malformed tokenBinding member on web-auth/webauthn-framework (1 day ago)
- ci: skip EventSubscriberToAttributeRector to keep the Rector job green on web-auth/webauthn-framework (1 day ago)
- Enrol aes-key-wrap on anthropics/oss-scanner (4 days ago)
- web-auth/webauthn-framework (5.3.12, 1 day ago) - WebAuthn and passkeys for PHP and Symfony.
- web-token/jwt-framework (4.2.4, 5 days ago) - JSON Web Tokens: JWS, JWE and JWK.
- leo-gan/GLD.SerializerBenchmark (v0.7.0, 6 days ago) - Serialization benchmarks (14 languages, ~20 standards, ~300 serializers), Compliance tests, Serialization 101–401 courses
- symfony/symfony (v8.1.10, 1 week ago) - The Symfony PHP framework
- symfony/framework-bundle (v8.1.10, 1 week ago) - Provides a tight integration between Symfony components and the Symfony full-stack framework
- symfony/security-core (v8.1.10, 1 week ago) - Symfony Security Component - Core Library
- symfony/security-http (v8.1.10, 1 week ago) - Symfony Security Component - HTTP Integration
- symfony/security-bundle (v8.1.10, 1 week ago) - Provides a tight integration of the Security component into the Symfony full-stack framework
- symfony/console (v8.1.10, 1 week ago) - Eases the creation of beautiful and testable command line interfaces
- symfony/mailer (v8.1.10, 1 week ago) - Helps sending emails
