Download the PHP package lindelius/php-jwt without Composer

php-jwt

A convenience library for working with JSON Web Tokens (JWT) in PHP.

This library conforms to RFC 7519, with the exception of not allowing unsigned JWTs (the "none" algorithm), and has built-in support for the following claims:

• The aud (audience) claim - Section 4.1.3
• The exp (expiration time) claim - Section 4.1.4
• The iat (issued at) claim - Section 4.1.6
• The iss (issuer) claim - Section 4.1.1
• The nbf (not before) claim - Section 4.1.5

Requirements

• PHP 7.2, or higher
• OpenSSL PHP extension (for certain algorithms)

Table of Contents

• Installation
• Usage
  • Algorithm Choices
  • Leeway Time
  • Multiple Encryption Keys
• Benchmarking

Installation

If you are using Composer, you may install the latest version of this library by running the following command from your project's root folder:

You may also manually download the library by navigating to the "Releases" page and then expanding the "Assets" section of the latest release.

Usage

Step 1. Extend the abstract JWT model and pick an algorithm.

Step 2. Start creating your JWTs :)

Step 3. Decode and verify the JWTs that are sent back.

If you are making use of any of the claims with built-in support (aud or iss), you may verify them by passing the expected values to the verify() method (as seen below).

Algorithm Choices

The following algorithms are currently included with the library:

• HS256
• HS384
• HS512
• RS256 (requires the OpenSSL extension)
• RS384 (requires the OpenSSL extension)
• RS512 (requires the OpenSSL extension)

You may use any of the built-in algorithms by simply including the relevant trait(s) in your JWT model.

If you would like to use an algorithm that is not yet included with the library you can easily add support for it by implementing the required encodeWithX() and verifyWithX() methods (in the same fashion as the currently included traits).

Leeway Time

If your application servers suffer from clock skew, you can make use of the JWT::$leeway property to give them a couple of extra seconds when verifying certain claims (exp, iat, and nbf).

It's highly recommended to keep the leeway time as low as possible.

Multiple Encryption Keys

If your application makes use of multiple encryption keys you will, in one way or another, have to keep track of which key was used for which JWT. One way to do this is to use the kid header field to include the "key ID" with the JWT.

If you use this approach, all you have to do when verifying the JWT is to provide the JWT::verify() method with $availableKeys and it will automatically look-up and use the correct key.

Benchmarking

This library is using PHPBench for benchmarking.

You can benchmark the library on your own system by running the following command from the library's root folder.