Download the PHP package connectholland/secure-jwt-bundle without Composer

Secure JWT Bundle

Symfony bundle that makes JWT more secure

Install

Installation is not fluent and error free yet, but it is easy to work around:

Will give error in post installation:

Configure scheb twofactor Google:

In the scheb_two_factor.yaml file:

Run

Again to finish the installation.

BTW1: Installation and configuration of the scheb twofactor bundle before installation of this bundle will also prevent this error.
BTW2: of course a PR that fixes these issues is welcome :)

Cookie storage

Tokens in local storage are insecure, so if you use tokens from a web interface you should store them somewhere else. A secure cookie is a good location. Configure cookie storage as follows:

Let the lexik/jwt-authentication-bundle look at cookies:

In the lexik_jwt_authentication.yaml config file:

Make sure the token is set as a secure cookie

In the security.yaml config file:

Invalidate tokens

By default tokens are valid until they expire. This makes is impossible to really log out. You can configure token invalidatation to allow logouts:

Create database table

In the doctrine.yaml file:

And run migrations:

Configure API endpoint logout

In the api_platform.yaml file:

Of course do not remove other required paths that might already be in the paths configuration.

There will be a logout endpoint in your API. This endpoint requires a message formatted like:

The value of logout is not important and not used. This field is required because API platform requires at least one field in the message. (A better solution for this is welcome).

Do not allow invalidated tokens

In the security.yaml file:

Two Factor Authentication in JWT

Configure Google Authenticator

In the scheb_two_factor.yaml file:

Use the two_factor_jwt security listener and provider

In the security.yaml file:

Implement the right interfaces

Your User object should implement ConnectHolland\SecureJWTBundle\Entity\TwoFactorUserInterface.

Using 2FA

This will give the following response:

If 2FA is not yet setup you will receive:

In the next call add the two factor challenge:

If correct you'll receive:

The response headers will include a secure cookie containing the JWT token to allow future authenticated calls.

2FA Remember this device

The remember device functionality allows users to skip the 2fa for a configurable amount of days. The default configuration is set to false, which means it doesn't set a REMEMBER_DEVICE cookie after logging in. The default amount of days is set to 30.

To configure:

In the config/packages folder of the root project create a new file called: connect_holland_secure_jwt.yaml

In this file the configuration can be set:

As mentioned before, after logging in a REMEMBER_DEVICE cookie will be set. It will contain a unix expiry time and the email of the user.

Besides placing the cookie it will be persisted in the: secure_jwt_remember_device_token table. This entity can be found in src/Entity/RememberDeviceToken.php

Recover codes

You can retrieve recovery codes for 2FA which allow you to reset 2FA. If a valid recovery code is entered as challenge, 2FA will be reset and you'll get a QR code response.