Download the PHP package auth0/jwt-auth-bundle without Composer

Symfony SDK for Auth0 Authentication and Management APIs.

:books: Feedback

Documentation

• Docs site — explore our docs site and learn more about Auth0.

Getting Started

Requirements

• PHP 8.1+
• Symfony 6.4 LTS or 7
  • Symfony 7 support is community-contributed and presently experimental.

Please review our support policy to learn when language and framework versions will exit support in the future.

Installation

Add the dependency to your application with Composer:

Configure Auth0

Create a Regular Web Application in the Auth0 Dashboard. Verify that the "Token Endpoint Authentication Method" is set to POST.

Next, configure the callback and logout URLs for your application under the "Application URIs" section of the "Settings" page:

• Allowed Callback URLs: URL of your application where Auth0 will redirect to during authentication, e.g., http://localhost:8000/callback.
• Allowed Logout URLs: URL of your application where Auth0 will redirect to after logout, e.g., http://localhost:8000/login.

Note the Domain, Client ID, and Client Secret. These values will be used later.

Configure the SDK

After installation, you should find a new file in your application, config/packages/auth0.yaml. If this file isn't present, please create it manually.

The following is an example configuration that will use environment variables to assign values. You should avoid storing sensitive credentials directly in this file, as it will often be committed to version control.

Configure your .env file

Create or open a .env.local file within your application directory, and add the following lines:

Please ensure this .env.local file is included in your .gitignore. It should never be committed to version control.

Configure your security.yaml file

Open your application's config/packages/security.yaml file, and update it based on the following example:

Update your config/bundle.php

The SDK bundle should be automatically detected and registered by Symfony Flex projects, but you may need to add the Auth0Bundle to your application's bundle registry. Either way, it's a good idea to register the bundle anyway, just to be safe.

Optional: Add Authentication helper routes

The SDK includes a number of pre-built HTTP controllers that can be used to handle authentication. These controllers are not required, but can be helpful in getting started. In many cases, these may provide all the functionality you need to integrate Auth0 into your application, providing a plug-and-play solution.

To use these, open your application's config/routes.yaml file, and add the following lines:

Recommended: Configure caching

The SDK provides two caching properties in it's configuration: token_cache and management_token_cache. These are compatible with any PSR-6 cache implementation, of which Symfony offers several out of the box.

These are used to store JSON Web Key Sets (JWKS) results for validating access token signatures and generated management API tokens, respectively. We recommended configuring this feature to improve your application's performance by reducing the number of network requests the SDK needs to make. It will also greatly help in avoiding hitting rate-limiting conditions, if you're making frequent Management API requests.

The following is an example config/packages/cache.yaml file that would configure the SDK to use a Redis backend for caching:

Please review the Symfony cache documentation for adapter-specific configuration options. Please note that the SDK does not currently support Symfony's "Cache Contract" adapter type.

Example: Retrieving the User

The following example shows how to retrieve the authenticated user within a controller. For this example, we'll create a mock ExampleController class that is accessible from a route at /private.

Add a route to your application's config/routes.yaml file:

Now update or create a src/Controller/ExampleController.php class to include the following code:

If you visit the /private route in your browser, you should see the authenticated user's details. If you are not already authenticated, you will be redirected to the /login route to login, and then back to /private afterward.

Support Policy

Our support windows are determined by the Symfony release support and PHP release support schedules, and support ends when either the Symfony framework or PHP runtime outlined below stop receiving security fixes, whichever may come first.

Deprecations of EOL'd language or framework versions are not considered a breaking change, as Composer handles these scenarios elegantly. Legacy applications will stop receiving updates from us, but will continue to function on those unsupported SDK versions.

Note: We do not currently support Symfony LTS versions, but anticipate adding support for this when Symfony's 6.x branch enters it's LTS window.

Note: Symfony 7 support is community-contributed, and currently considered experimental.

Feedback

Contributing

We appreciate feedback and contribution to this repo! Before you get started, please see the following:

• Auth0's general contribution guidelines
• Auth0's code of conduct guidelines

Raise an issue

To provide feedback or report a bug, please raise an issue on our issue tracker.

Vulnerability Reporting

Please do not report security vulnerabilities on the public Github issue tracker. The Responsible Disclosure Program details the procedure for disclosing security issues.

Auth0 is an easy to implement, adaptable authentication and authorization platform.
To learn more checkout Why Auth0?

This project is licensed under the MIT license. See the LICENSE file for more info.