Download the PHP package kelvinmo/simplejwt without Composer
On this page you can find all versions of the php package kelvinmo/simplejwt. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.
Download kelvinmo/simplejwt
More information about kelvinmo/simplejwt
Files in kelvinmo/simplejwt
Package simplejwt
Short Description A simple JSON Web Token library for PHP.
License BSD-3-Clause
Homepage https://github.com/kelvinmo/simplejwt
Informations about the package simplejwt
SimpleJWT
SimpleJWT is a simple JSON web token library written in PHP.
Features
- JSON web token RFC7519, JSON web signatures RFC7515 and JSON web encryption RFC7516
- JSON web keys RFC7517
- COSE key objects RFC9053
- Signature algorithms
- HMAC family (HS256, HS384, HS512)
- RSA family (RS256, RS384, RS512)
- ECDSA family (ES256, ES384, ES512)
- EdDSA
- Key management algorithms
- Key agreement or direct encryption
- RSAES-PKCS1-v1_5 (RSA1_5)
- RSAES with OAEP (RSA-OAEP, RSA-OAEP-256)
- AES key wrap (A128KW, A192KW, A256KW, A128GCMKW, A192GCMKW, A256GCMKW)
- PBES2 (PBES2-HS256+A128KW, PBES2-HS384+A192KW, PBES2-HS512+A256KW)
- Elliptic Curve Diffie-Hellman (ECDH-ES), including X25519
- Content encryption algorithms
- AES_CBC_HMAC_SHA2 family (A128CBC-HS256, A192CBC-HS384, A256CBC-HS512)
- AES GCM family (A128GCM, A192GCM, A256GCM)
Requirements
- PHP 8.0 or later
gmp
extensionhash
extensionopenssl
extensionsodium
extension for EdDSA and X25519 support
Installation
You can install via Composer.
Usage
Key set
Keys used to sign or verify a JWT must firstly be added to a KeySet. You can add keys in the following ways:
-
By loading a JSON object formatted as a JWK Set object as per RFC7517:
-
By adding a key manually:
- For a secret used in HMAC signatures, directly:
Creating a JWT
To create a JWT, set up the desired headers and claims as separate arrays, then
create a JWT
object:
The JWT can then be signed and encoded:
By default, SimpleJWT will automatically include a kid
(Key ID) header and
a iat
(Issued At) claim in all JWTs. If the key used to sign the JWT does
not have a kid
assigned (e.g. if it is imported from a PEM file), a kid
is generated. You can disable this behaviour by specifying $auto_complete
to false when calling SimpleJWT\JWT::encode()
.
Verifying a JWT
To consume and verify a JWT, use the decode function. Note that you will need
to supply the expected alg
parameter that has been previously agreed out-of-band.
Deserialising a JWT
You can also deserialise a JWT without verifying it using the deserialise function. Note that you should not trust the contents of the data contained in a JWT without verifying them.
Creating a JWE
To create a JWE, set up the desired header array and plaintext, then
create a JWE
object:
The JWE can then be encrypted:
Decrypting a JWE
To decrypt a JWE, use the decrypt function:
Licence
BSD 3 clause
All versions of simplejwt with dependencies
ext-openssl Version *
ext-hash Version *
ext-gmp Version *