Download the PHP package dimkinthepro/jwt-auth-bundle without Composer

On this page you can find all versions of the php package dimkinthepro/jwt-auth-bundle. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.

FAQ

After the download, you have to make one include require_once('vendor/autoload.php');. After that you have to import the classes with use statements.

Example:
If you use only one package a project is not needed. But if you use more then one package, without a project it is not possible to import the classes with use statements.

In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
Some PHP packages are not free to download and because of that hosted in private repositories. In this case some credentials are needed to access such packages. Please use the auth.json textarea to insert credentials, if a package is coming from a private repository. You can look here for more information.

  • Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
  • To use Composer is sometimes complicated. Especially for beginners.
  • Composer needs much resources. Sometimes they are not available on a simple webspace.
  • If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
  • Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Please rate this library. Is it a good library?

Example code of dimkinthepro/jwt-auth-bundle

Informations about the package jwt-auth-bundle

JWT authentication bundle for Symfony

1. Installation:

2. Check bundles config:

3. Create bundle configuration:

4. Add security configuration

5. Add doctrine configuration

6. Add Routes

7. Generate migrations:

8. Generate key pair:

9. Schedule expired refresh tokens purge (e.g. daily cron):

10. Add custom JWT claims (optional):

Listen to JwtTokenCreatedEvent — reserved claims (identifier, iat, exp) cannot be overridden.

Read the claims back from the verified token:

11. Hook into the token lifecycle with events (optional):

Event When What listeners can do
JwtTokenCreatedEvent before the token is signed adjust claims (getClaims()/setClaims())
JwtTokenDecodedEvent after a token passed validation run extra checks, markAsInvalid() to reject
JwtTokenAuthenticatedEvent request authenticated with a JWT add passport attributes from token claims
JwtAuthenticationSuccessEvent successful login, before the response enrich response data (getData()/setData())
JwtTokenNotFoundEvent protected endpoint hit without a token replace the default 401 response
JwtTokenInvalidEvent authentication failed: bad token replace the default 401 response
JwtTokenExpiredEvent authentication failed: expired token replace the default 401 response

The header and the reserved claims (identifier, iat, exp) cannot be changed from listeners.

12. Device sessions:

Every refresh token represents a device session. On login the bundle captures the optional deviceName field of the JSON body (native clients know their exact model), the User-Agent header and the client IP:

The session identity (sessionId, createdAt, deviceName) survives token rotation; lastUsedAt is updated on every refresh, and each issued JWT carries its session id in the sid claim.

GET /api/sessions (authenticated) returns the devices of the current user, marking the session the request was made from:

DELETE /api/sessions/{sessionId} revokes a session (204; foreign or unknown ids give 404), DELETE /api/sessions revokes every session of the user (e.g. on account compromise).

Without the blocklist a revoked device keeps access until its short-lived JWT expires; with blocklist.enabled: true the outstanding access tokens die instantly.

With the blocklist enabled every token must carry the sid claim: a token without a session id could never be revoked, so it is rejected. Tokens issued by the login and refresh endpoints always have it; when creating tokens manually, pass a session id to TokenService::createJwtToken().

13. Split cookies for browser SPAs (optional):

Enable the split_cookie extractor and set the cookies on login with a kernel.response listener — the signature cookie is HttpOnly, so an XSS attack can never read a complete usable token:

All versions of jwt-auth-bundle with dependencies

PHP Build Version
Package Version
Requires php Version >=8.4
ext-openssl Version *
doctrine/doctrine-bundle Version ^2 || ^3
doctrine/orm Version ^2 || ^3
psr/cache Version ^2 || ^3
symfony/config Version ^7 || ^8
symfony/console Version ^7 || ^8
symfony/dependency-injection Version ^7 || ^8
symfony/event-dispatcher Version ^7 || ^8
symfony/form Version ^7 || ^8
symfony/framework-bundle Version ^7 || ^8
symfony/http-kernel Version ^7 || ^8
symfony/security-bundle Version ^7 || ^8
symfony/validator Version ^7 || ^8
Composer command for our command line client (download client) This client runs in each environment. You don't need a specific PHP version etc. The first 20 API calls are free. Standard composer command

The package dimkinthepro/jwt-auth-bundle contains the following files

Loading the files please wait ...