# I would like to know if Zend-expressive framewok is a good choice or not,

**URL:** <https://discourse.laminas.dev/t/i-would-like-to-know-if-zend-expressive-framewok-is-a-good-choice-or-not/638>\
**Category:** Mezzio\
**Tags:** expressive\
**Created:** [July 2, 2018, 12:10pm UTC](https://discourse.laminas.dev/t/i-would-like-to-know-if-zend-expressive-framewok-is-a-good-choice-or-not/638 "2018-07-02T12:10:49Z")\
**Posts on this page:** 18\
**Page:** 1

<div class="post-metadata">

**Author:** ![nour](https://avatars.discourse-cdn.com/v4/letter/n/df788c/32.png) [@nour](https://discourse.laminas.dev/u/nour)\
**Post date:** [July 2, 2018, 12:10pm UTC](https://discourse.laminas.dev/t/i-would-like-to-know-if-zend-expressive-framewok-is-a-good-choice-or-not/638/1 "2018-07-02T12:10:49Z")

</div>

I would like to know if Zend-expressive framewok is a good choice or not,  
I have been working with the zendframework since 2006.  
I switched to Zend-expressive but I see very few updates and packages.

Can someone tell me whether it is wise to go with a zend-expressive or not.

---

<div class="post-metadata">

**Author:** ![froschdesign](https://yyz2.discourse-cdn.com/flex032/user_avatar/discourse.laminas.dev/froschdesign/32/38_2.png) [@froschdesign](https://discourse.laminas.dev/u/froschdesign)\
**Post date:** [July 2, 2018, 12:20pm UTC](https://discourse.laminas.dev/t/i-would-like-to-know-if-zend-expressive-framewok-is-a-good-choice-or-not/638/2 "2018-07-02T12:20:56Z")

</div>

> [@nour](#):
>
> …but I see very few updates and packages.

It does not need extra packages for expressive. You can use all others like zend-barcode, zend-crypt, zend-form, zend-paginator, zend-validator; also PHP packages like sabre/xml, Intervention Image, PhpSpreadsheet and what you need for your application.

---

<div class="post-metadata">

**Author:** ![matthew](https://yyz2.discourse-cdn.com/flex032/user_avatar/discourse.laminas.dev/matthew/32/14_2.png) [@matthew](https://discourse.laminas.dev/u/matthew)\
**Post date:** [July 2, 2018, 2:45pm UTC](https://discourse.laminas.dev/t/i-would-like-to-know-if-zend-expressive-framewok-is-a-good-choice-or-not/638/3 "2018-07-02T14:45:59Z")

</div>

> [@nour](#):
>
> I switched to Zend-expressive but I see very few updates and packages.

This will be true if you’re looking at the zendframework/zendframework package… because it’s a _metapackage_. In other words, all it does is install _other_ packages. What you need to look at is the various packages on which it depends if you want to see activity. And I can tell you right now: every. single. package. on. which. it. depends. has. had. multiple. new. releases. this. year.

In fact, most had multiple releases last year as well. As I noted in our year-end wrap up in 2017, we published over 260 releases across more than 80 packages last year alone, and we have done similar numbers in the first 6 months of 2018 alone.

If you’re talking about Zend Expressive not getting many updates, perhaps you missed the fact that we released version 3 a few months back? and have had incremental updates to most of the core Expressive packages in the months since? We don’t update the skeleton regularly… because, like the zendframework package, it’s a metapackage, too. Look at the dependencies to get an idea of updates.

I apologize if I’m coming off angry or dismissive; the community puts in a ton of work to get new updates out regularly, and to hear folks claim off-hand that the project has “few updates” or “few packages” (we have almost 200 packages in the ZF/Expressive/Apigility ecosystem!), without qualifying the claim, it feels rather dismissive.

You can help us out: what gives you the impression of few updates? Where do you look for information on updates? If we can get an idea of where people are looking, we can better understand why this impression persists, and come up with solutions for getting our information in front of you, so you’re not working with incorrect data.

---

<div class="post-metadata">

**Author:** ![nour](https://avatars.discourse-cdn.com/v4/letter/n/df788c/32.png) [@nour](https://discourse.laminas.dev/u/nour)\
**Post date:** [July 2, 2018, 9:22pm UTC](https://discourse.laminas.dev/t/i-would-like-to-know-if-zend-expressive-framewok-is-a-good-choice-or-not/638/4 "2018-07-02T21:22:36Z")

</div>

Sorry but when i loot at the documentation of the authentication and authorization for laravel i found that easy to implement and the documentation is complete.

I want to implement the authentication and authorization middelware for zend-expressive  
but every time I look in github I see this message “ **_WORK IN PROGRESS_** ” that message I see for months. are there good authentication and authorization modules for zend-expressive? because these modules are very important for every application

> **[zendframework/zend-expressive-authentication](https://github.com/zendframework/zend-expressive-authentication)**
>
> Authentication middleware for Expressive and PSR-7 applications - zendframework/zend-expressive-authentication

  

> **[zendframework/zend-expressive-authorization](https://github.com/zendframework/zend-expressive-authorization)**
>
> Authorization middleware for PSR-7 applications and Expressive - zendframework/zend-expressive-authorization

---

<div class="post-metadata">

**Author:** ![froschdesign](https://yyz2.discourse-cdn.com/flex032/user_avatar/discourse.laminas.dev/froschdesign/32/38_2.png) [@froschdesign](https://discourse.laminas.dev/u/froschdesign)\
**Post date:** [July 3, 2018, 3:12am UTC](https://discourse.laminas.dev/t/i-would-like-to-know-if-zend-expressive-framewok-is-a-good-choice-or-not/638/5 "2018-07-03T03:12:52Z")

</div>

> [@nour](#):
>
> I want to implement the authentication and authorization middelware for zend-expressive

This is an important detail of this forum thread! Why is this information missing in your initial post?  
Please always formulate your questions completely, this will save you and others a lot of work. In addition, no one has to guess. Thanks!

---

<div class="post-metadata">

**Author:** ![matthew](https://yyz2.discourse-cdn.com/flex032/user_avatar/discourse.laminas.dev/matthew/32/14_2.png) [@matthew](https://discourse.laminas.dev/u/matthew)\
**Post date:** [July 3, 2018, 1:47pm UTC](https://discourse.laminas.dev/t/i-would-like-to-know-if-zend-expressive-framewok-is-a-good-choice-or-not/638/6 "2018-07-03T13:47:45Z")

</div>

The reason the authorization and authentication middleware are still in progress is because we have wanted to ensure we address as many use cases _as presented by our users_ as possible. We hope to finalize them within the next two months.

That said, ANY middleware compatible with PSR-15 (and even double-pass, legacy PSR-7 middleware) can be used with Expressive. Our own OAuth2 adapter for authentication is a wrapper over the league/oauth2-server, which can be dropped into Expressive by itself. (We are wrapping it to provide common interfaces around users and reporting “unauthenticated” responses, which will allow us to provide standardized authorization more easily.)

Yes, the projects have been in that status for months; this is because it takes time to get the code correct. We’ve already changed the interfaces several times, which we will not be able to do once we hit a stable release.

In the meantime, search [Packagist](https://packagist.org) for authentication and/or authorization middleware for 3rd party solutions.

---

<div class="post-metadata">

**Author:** ![MichaelB](https://avatars.discourse-cdn.com/v4/letter/m/b19c9b/32.png) [@MichaelB](https://discourse.laminas.dev/u/MichaelB)\
**Post date:** [July 5, 2018, 7:57am UTC](https://discourse.laminas.dev/t/i-would-like-to-know-if-zend-expressive-framewok-is-a-good-choice-or-not/638/7 "2018-07-05T07:57:16Z")

</div>

All expressive modules for authentication and authorization are essentials for me and my projects.

I already use Expressive 3 for some basic websites (no authentication) and also use for one intranet apps with zend-expressive-authentication and zend-expressive-authentication-session (apps with login access). Yes i know that authentication/authorization it is not 100% ready, i hope will have not too much BC break until 1.0 😉

I also have project for API apps with zend-expressive-authentication-oauth2 but for this one i’m waiting because is a big project.

I really like to work with Expressive 3 but yes will be a good news when all authentication and authorization modules will be stabilised and 100% ready for production.

---

<div class="post-metadata">

**Author:** ![xtreamwayz](https://yyz2.discourse-cdn.com/flex032/user_avatar/discourse.laminas.dev/xtreamwayz/32/27_2.png) [@xtreamwayz](https://discourse.laminas.dev/u/xtreamwayz)\
**Post date:** [July 21, 2018, 7:21am UTC](https://discourse.laminas.dev/t/i-would-like-to-know-if-zend-expressive-framewok-is-a-good-choice-or-not/638/8 "2018-07-21T07:21:31Z")

</div>

> [@nour](#):
>
> I switched to Zend-expressive but I see very few updates and packages.

If there are no bugs reported and everything is working correctly, there is no need to update a package on a weekly base. Since zendframework 2.5 packages follow their own release schedule. So while one package is still developed as 2.x, others are already 3.x or even [higher](https://github.com/zendframework/zend-expressive-helpers/releases).

To addition what the others said already, zend-expressive-authentication and related packages already had [1.0.0alpha releases](https://github.com/zendframework/zend-expressive-authentication/releases). However we found that the packages were not feature complete and decided to go back to 0.x releases. This is also the reason the documentation might not be complete yet.

I’m already using these auth packages in a project I’m currently building and it’s working fine and does what I need it to do since the latest release.

To speed up development and releasing a stable version, you could try out the packages, test it and give your feedback and/or help out document it.

---

<div class="post-metadata">

**Author:** ![cloudenv](https://yyz2.discourse-cdn.com/flex032/user_avatar/discourse.laminas.dev/cloudenv/32/366_2.png) [@cloudenv](https://discourse.laminas.dev/u/cloudenv)\
**Post date:** [July 28, 2018, 7:21pm UTC](https://discourse.laminas.dev/t/i-would-like-to-know-if-zend-expressive-framewok-is-a-good-choice-or-not/638/9 "2018-07-28T19:21:07Z")

</div>

Weekly, monthly, or even (twice, thrice) **daily** -\> update **must not** be based on schedule, but on necessity…

There is nothing wrong in updating many times throughout single day…

---

<div class="post-metadata">

**Author:** ![matthew](https://yyz2.discourse-cdn.com/flex032/user_avatar/discourse.laminas.dev/matthew/32/14_2.png) [@matthew](https://discourse.laminas.dev/u/matthew)\
**Post date:** [July 30, 2018, 6:50pm UTC](https://discourse.laminas.dev/t/i-would-like-to-know-if-zend-expressive-framewok-is-a-good-choice-or-not/638/10 "2018-07-30T18:50:43Z")

</div>

> There is nothing wrong in updating many times throughout single day…

And the corollary is: there is nothing wrong with performing no releases if no changes are currently necessary or proposed, or if the changes need more time to test.

The insistence by many developers that the _activity_ of a project is related to _quality_ in any way is, frankly, ridiculous. In many ways, _less activity_ is often a more sure sign of _better quality_. But using either metric in isolation is a fallacy.

---

<div class="post-metadata">

**Author:** ![cloudenv](https://yyz2.discourse-cdn.com/flex032/user_avatar/discourse.laminas.dev/cloudenv/32/366_2.png) [@cloudenv](https://discourse.laminas.dev/u/cloudenv)\
**Post date:** [August 4, 2018, 10:38am UTC](https://discourse.laminas.dev/t/i-would-like-to-know-if-zend-expressive-framewok-is-a-good-choice-or-not/638/11 "2018-08-04T10:38:40Z")

</div>

> [@matthew](#):
>
> _less activity_ is often a more sure sign of _better quality_ .

Could not be more wrong…  
The more activity, the better/higher quality… I dont see how less activity equals higher quality… make no-sense for me.

> [@matthew](#):
>
> The insistence by many developers that the _activity_ of a project is related to _quality_ in any way is, frankly, **ridiculous**.

No its **NOT** ridiculous… its clear-thinking, or, if you prefer, sign of wisdom and/or project-oriented thinking…

> [@matthew](#):
>
> But using either metric in isolation is a fallacy.

Please ellaborate…

---

<div class="post-metadata">

**Author:** ![ocramius](https://yyz2.discourse-cdn.com/flex032/user_avatar/discourse.laminas.dev/ocramius/32/23_2.png) [@ocramius](https://discourse.laminas.dev/u/ocramius)\
**Post date:** [August 5, 2018, 3:22pm UTC](https://discourse.laminas.dev/t/i-would-like-to-know-if-zend-expressive-framewok-is-a-good-choice-or-not/638/12 "2018-08-05T15:22:23Z")

</div>

> cloudenv [https://discourse.zendframework.com/u/cloudenv](https://discourse.zendframework.com/u/cloudenv)  
> August 4
> 
> matthew:
> 
> _less activity_ is often a more sure sign of _better quality_ .
> 
> Could not be more wrong…  
> The more activity, the better/higher quality… I dont see how less activity  
> equals higher quality… make no-sense for me.

I’m just going to throw in a data point here, in order to make this clear  
with a personal example:

> **[Install Statistics - ocramius/proxy-manager - Packagist](https://packagist.org/packages/ocramius/proxy-manager/stats)**
>
> The PHP Package Repository

Extremely carefully crafted. Not all design decisions are correct, but  
everything is tested to paranoid levels (As it frikken should be! Test your  
code, people!).  
The result is a few million downloads with basically no activity at all (  
[Pulse · Ocramius/ProxyManager · GitHub](https://github.com/Ocramius/ProxyManager/pulse/monthly)). Also no new  
feature requests: it does what it is supposed to do.  
Feel free to prove me wrong, but this is what stability and quality are.

> matthew:
> 
> The insistence by many developers that the _activity_ of a project is  
> related to _quality_ in any way is, frankly, _ridiculous_.
> 
> No its _NOT_ ridiculous… its clear-thinking, or, if you prefer, sign of  
> wisdom and/or project-oriented thinking…

I think the same example of the above one counts here.

matthew:

> But using either metric in isolation is a fallacy.
> 
> Please ellaborate…

You could have a project with fantastic quality and no activity at all  
because nobody is using it, hence why I correlated it with usage  
(downloads) above.

Marco Pivetta

[http://twitter.com/Ocramius](http://twitter.com/Ocramius)

[http://ocramius.github.com/](http://ocramius.github.com/)

---

<div class="post-metadata">

**Author:** ![cloudenv](https://yyz2.discourse-cdn.com/flex032/user_avatar/discourse.laminas.dev/cloudenv/32/366_2.png) [@cloudenv](https://discourse.laminas.dev/u/cloudenv)\
**Post date:** [August 8, 2018, 2:04pm UTC](https://discourse.laminas.dev/t/i-would-like-to-know-if-zend-expressive-framewok-is-a-good-choice-or-not/638/13 "2018-08-08T14:04:43Z")

</div>

> [@ocramius](#):
>
> few million downloads

This alone is quite impressive… Thats nice indeed.  
But this **has nothing to do** with meritum.

---

<div class="post-metadata">

**Author:** ![matthew](https://yyz2.discourse-cdn.com/flex032/user_avatar/discourse.laminas.dev/matthew/32/14_2.png) [@matthew](https://discourse.laminas.dev/u/matthew)\
**Post date:** [August 13, 2018, 2:12pm UTC](https://discourse.laminas.dev/t/i-would-like-to-know-if-zend-expressive-framewok-is-a-good-choice-or-not/638/14 "2018-08-13T14:12:32Z")

</div>

> [@cloudenv](#):
>
> But this **has nothing to do** with meritum

And neither does project activity. That’s the point we’re trying to establish.

High number of downloads, with low levels of issues and feature requests, however, _likely_ indicates that the project is a) useful, and b) does what users expect it to do. High amounts of issues, feature requests, and releases, while indicative of people engaging with the project, does not necessarily mean the project is a) generally of good quality, or b) does what it’s supposed to. Don’t mistake project churn for quality.

---

<div class="post-metadata">

**Author:** ![davidmintz](https://yyz2.discourse-cdn.com/flex032/user_avatar/discourse.laminas.dev/davidmintz/32/213_2.png) [@davidmintz](https://discourse.laminas.dev/u/davidmintz)\
**Post date:** [August 22, 2018, 3:00pm UTC](https://discourse.laminas.dev/t/i-would-like-to-know-if-zend-expressive-framewok-is-a-good-choice-or-not/638/15 "2018-08-22T15:00:27Z")

</div>

Other data that can be ambiguous: the size and activity level of a project’s online community. Big community correlates to wide adoption correlates to quality, I think. But if there are a zillion questions per day on Stackoverflow about a project, that may cut the other way: hard to use. Or at least, difficult learning curve.

---

<div class="post-metadata">

**Author:** ![nour](https://avatars.discourse-cdn.com/v4/letter/n/df788c/32.png) [@nour](https://discourse.laminas.dev/u/nour)\
**Post date:** [August 25, 2018, 10:55am UTC](https://discourse.laminas.dev/t/i-would-like-to-know-if-zend-expressive-framewok-is-a-good-choice-or-not/638/16 "2018-08-25T10:55:39Z")

</div>

someone knows when authorization and authentication packages are ready?

---

<div class="post-metadata">

**Author:** ![xtreamwayz](https://yyz2.discourse-cdn.com/flex032/user_avatar/discourse.laminas.dev/xtreamwayz/32/27_2.png) [@xtreamwayz](https://discourse.laminas.dev/u/xtreamwayz)\
**Post date:** [August 25, 2018, 3:04pm UTC](https://discourse.laminas.dev/t/i-would-like-to-know-if-zend-expressive-framewok-is-a-good-choice-or-not/638/17 "2018-08-25T15:04:14Z")

</div>

Looks like they may get a stable release soon: [https://github.com/zendframework/zend-expressive-authentication/issues/35#issuecomment-415092022](https://github.com/zendframework/zend-expressive-authentication/issues/35#issuecomment-415092022)

---

<div class="post-metadata">

**Author:** ![nour](https://avatars.discourse-cdn.com/v4/letter/n/df788c/32.png) [@nour](https://discourse.laminas.dev/u/nour)\
**Post date:** [August 26, 2018, 8:18pm UTC](https://discourse.laminas.dev/t/i-would-like-to-know-if-zend-expressive-framewok-is-a-good-choice-or-not/638/18 "2018-08-26T20:18:50Z")

</div>

Thanks for the info 😉