Download the PHP package facile-it/php-jose-verifier without Composer

Facile JOSE Verifier

A library to validate JWT tokens.

How To Use

The suggested and simply way to use it (specially for OAuth2 and OpenID tokens) is using builders.

For better performance you should install ext-gmp.

Create verifiers from Issuer and Client Metadata

Usually an OpenID provider provides an openid-configuration (/.well-known/openid-configuration).

You can fetch the configuration and use it with builders, but usually only issuer and jwks_uri are necessary.

The remote jwks_uri is the remote endpoint where the issuer public keys are exposed.

You also need the Client Metadata, usually the same provided from the OpenID Dynamic Registration but you can just provide the client_id and optionally the client_secret (in case the tokens are signed with symmetric key using the client secret).

Verfiers and decrypters are automatically configured using the OpenID Dynamic Registration client metadata.

If you use encryption, you should inject your JWK Set in the configuration jwks keys.

The verifier will decrypt and validate the token for you. The result is the token payload.

Using cache to fetch remote JWK Set

Obviously you should not fetch the remote JWK Set on every request. In order to use cache you can inject a partially configured JwksProviderBuilder.

Provided verifiers

Access Token Verifier

The AccessTokenVerifier will validate a JWT access token.

ID Token Verifier

The IdTokenVerifier will validate an OpenID id_token.

Create the verifier:

In order to validate an id_token you must provide some other parameters to the verifier (note that all verifiers are immutable).

UserInfo Verifier

When UserInfo returns a signed (and maybe encrypted) JWT as response content of the userinfo endpoint you can use this verifier to decrypt, verify, and obtain user info claims.