Download the PHP package alexeichhorn/json-work-proof without Composer
On this page you can find all versions of the php package alexeichhorn/json-work-proof. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.
Download alexeichhorn/json-work-proof
More information about alexeichhorn/json-work-proof
Files in alexeichhorn/json-work-proof
Package json-work-proof
Short Description JSON Work Proof (JWP) - proof-of-work algorithm
License MIT
Homepage https://losjet.com
FAQ
Example:
In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
- Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
- To use Composer is sometimes complicated. Especially for beginners.
- Composer needs much resources. Sometimes they are not available on a simple webspace.
- If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
- Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Informations about the package json-work-proof
JSON Work Proof
JSON Work Proof is a proof-of-work algorithm that creates a token after doing some workload. This token contains certain claims defined by you and verifies that you did this work at this time and for these claims.
It packs the security of the Hashcash algorithm (used for Bitcoin in a similar way) into a modern JWT-like token.
Structure of Token
A token looks like this: eyJ0eXAiOiJKV1AiLCJhbGciOiJTSEEyNTYiLCJkaWYiOjIwfQ.eyJleHAiOjE2MTY4NTA1NzAuNjU1MTQ3MSwiaGVsbG8iOiJ3b3JsZCJ9.VE6YYxIQ46lPzxyNuRYAmAMkEM. It has the same structure as a JWT token and can therefore also be inspected on the Debugger on jwt.io.
It contains three elements which are each base64url encoded. The header contains the type of the token (JWP), the hash algorithm used for the challenge (currently only SHA256 supported) and the difficulty at which the token was mined. The payload consists of the claims you specified and optionally an expiration date. The last part contains a salt and a big number (named counter in Hashcash). The work needed to generate a token is actually to find this number. It's hard to find this number, but easy to verify it's correct. (Read more about how it works on Wikipedia)
Possible Applications
Can be used to prevent DDOS attacks or as an alternative to rate limiting or captchas.
E.g. you can use this to prevent brute forcing user logins: The client generates a token with the claims including username and password and sends it along with the login request. The server then first checks if the token is valid before it does any lookup. The scale of bruteforcing can therefore be massively reduced.
Usage
Note: Currently only decoding is supported in PHP.
General
To generate and validate tokens you need to use a JWP-object. On creation you can specify the difficulty, which determines how hard the challenge should be. It defaults to 20, which takes about a second to compute on an average computer. Each increment by one, doubles the difficulty and therefore the time it takes to generate.
Generation
Currenlty not supported in PHP
Validation
To check if a token is valid for a certain difficulty and to read the claims:
If you just want to read the claims without verifying the proof and expiration date, you can use this instead:
It expects the expiration date to be between now and 30 minutes in the future.
