Download the PHP package fguillot/json-rpc without Composer

JSON-RPC PHP Client and Server

A simple JSON-RPC client/server that just works.

Project status

This repository is the maintained continuation of the original fguillot/JsonRPC library, which was abandoned and removed from GitHub by its original author. The package keeps its original name fguillot/json-rpc on Packagist so existing installations keep working; this repository (matasarei/json-rpc) is the canonical source. The library is in maintenance mode: it receives bug fixes, security fixes and compatibility updates for new PHP versions.

Features

• JSON-RPC 2.0 only
• Client and server for batch requests and notifications
• HTTP Basic authentication and IP-based client restrictions
• Custom middleware
• PSR-3 logging of requests and responses (with credential redaction)
• No hard runtime dependency beyond ext-json and psr/log
• Works with the curl extension or, as a fallback, plain PHP streams
• Fully unit tested, statically analysed (PHPStan) and PSR-12 compliant
• Requires PHP 8.0+
• License: MIT

Contributors

Frédéric Guillot and many others:

Requirements

• PHP 8.0 or later
• ext-json
• ext-curl is optional; when it is not available the client transparently falls back to PHP streams

Installation with Composer

Examples

• Server
• Client
• Client batch requests
• Client notifications
• Client exceptions
• Client logging and debugging
• IP based client restrictions
• HTTP Basic Authentication
• Local Exceptions
• Production hardening
• Callback before client request

Symfony

• https://github.com/matasarei/json-rpc-demo

Server

Callback binding:

Callback binding from array:

Class/Method binding:

Class/Method binding from array:

Server Middleware:

Middleware might be used to authenticate and authorize the client. They are executed before each procedure.

You can raise a AuthenticationFailureException when the API credentials are wrong or a AccessDeniedException when the user is not allowed to access to the procedure.

Client

Example with positional parameters:

Example with named arguments:

Arguments are called in the right order.

Examples with the magic method __call():

The example above use positional arguments for the request and this one use named arguments:

Client batch requests

Call several procedures in a single HTTP request:

All results are stored at the same position of the call.

Client notifications

A notification is a request without an id member: the server executes the procedure but does not send any response back.

Notifications can also be mixed into a batch request; only the regular calls produce results:

Client exceptions

Client exceptions are normally thrown when an error is returned by the server. You can change this behaviour by using the $returnException argument which causes exceptions to be returned. This can be extremely useful when executing the batch request.

• BadFunctionCallException: Procedure not found on the server
• InvalidArgumentException: Wrong procedure arguments
• JsonRPC\Exception\AccessDeniedException: Access denied
• JsonRPC\Exception\ConnectionFailureException: Connection failure
• JsonRPC\Exception\ServerErrorException: Internal server error

Client logging and debugging

The HTTP client accepts any PSR-3 logger and logs the JSON request and response (with debug level) through it:

Sensitive headers (Authorization, Cookie, Proxy-Authorization) are redacted before logging.

If you do not use a logging framework, the legacy debug mode writes the same messages to the PHP system logger (configurable via error_log in php.ini):

IP based client restrictions

The server can allow only some IP addresses:

If the client is blocked, you got a 403 Forbidden HTTP response.

HTTP Basic Authentication

If you use HTTPS, you can allow client by using a username/password.

On the client, set credentials like that:

If the authentication failed, the client throw a RuntimeException.

Using an alternative authentication header:

The example above will use the HTTP header X-Authentication instead of the standard Authorization: Basic [BASE64_CREDENTIALS]. The username/password values need be encoded in base64: base64_encode('username:password').

Local Exceptions

By default, the server will relay all exceptions to the client. If you would like to relay only some of them, use the method Server::withLocalException($exception):

Production hardening

Two opt-in server options are recommended when exposing the server publicly. Both default to the previous behaviour, so they never change existing deployments unless you enable them.

Hide internal exception details from clients — any exception that is not a JSON-RPC exception (and not registered as a local exception) is returned as a generic -32603 Internal error instead of leaking its message (database errors, file paths, stack context):

You can still return intentional, client-facing errors by throwing JsonRPC\Exception\ResponseException, which carries its own message, code and data.

Limit the number of calls accepted in a single batch to mitigate denial-of-service; larger batches are rejected with -32600 Invalid Request:

See SECURITY.md for the full security model and hardening guidance.

Callback before client request

You can use a callback to change the HTTP headers or the URL before to make the request to the server.

Example:

Development

Install the dependencies and run the checks: