Download the PHP package mixerapi/jwt-auth without Composer

MixerApi JwtAuth

A JWT authentication library for CakePHP supporting both HMAC (HS256 or HS512) and RSA (RS256 or RS512) with JSON Web Keys. Before starting, you should determine which signing algorithm best fits your needs. It is the goal of this library to make both easy.

• Installation
• Defining Your JWT
• JSON Web Keys
• Login Controller
• Security

For an alternative approach see admad/cakephp-jwt-auth.

Installation

You can install this plugin into your CakePHP application using composer.

And then load the plugin

Configuration

Next create a config file (e.g. config/mixerapi_jwtauth.php) and load it into your application.

alg

The alg string is required and must be either HS256, HS512, RS256, or RS512.

secret

The secret string is required when using HMAC. The secret should not be committed to your VCS and be at least 32 characters long. You can generate a strong secret using a tool like openssl or gpg:

keys

The keys array is required when using RSA. The keys should not be committed to your VCS and be at least 2048 bits long. You can generate a public/private keypair using openssl:

Service Provider

Using the JwtAuthServiceProvider is recommended to inject dependencies automatically.

Authentication

You will need to configure CakePHP Authentication to use this library. There are several ways to do this documented in the quick start. See the mixerapi demo for a complete example.

Be sure to load the CakePHP Authentication.Component (generally in your AppController).

Here is an example that supports both HMAC and RSA with form and password based authentication. However way you implement authentication, it is advised to use \MixerApi\JwtAuth\Configuration\Configuration to pull values from your MixerApi.JwtAuth configuration file config/mixerapi_jwtauth.php. This will validate your configuration before applying it to your applications authentication.

Defining your JWT

On your User entity implement JwtEntityInterface. This will be used to generate the JWT, example:

JSON Web Keys

Signing your tokens with RSA uses a public/private key pair. You can skip this section if you are using HMAC.

Building Keys

We'll store the keys in config/keys/1/ but you can store these anywhere. Keys should not be stored in version control, example:

JWK Set Controller

Read more about JSON Web Keys here. Let's create an endpoint to expose your JWK Set.

Add a route to your controller in your config/routes.php file.

Example response:

You may add/remove keys to your MixerApi.JwtAuth.keys config as part of your key rotation strategy.

Note, if you are not using dependency injection:

Login Controller

In the example below we'll authenticate, create the JWT we defined earlier and return it to the requester.

Add a route to the controller in your config/routes.php file.

This will build the JWT we defined earlier in the User Entity.

Note, if you're not using dependency injection:

Or, if you prefer to handle the authentication yourself you may pass an instance of JwtInterface instead, example:

Security

Some security measures are baked into this library:

Weak HMAC secrets

JWT signed with HMAC can be brute forced with a tool like JWT Tool. Once cracked the JWT can be altered. This library mitigates this by requiring a minimum secret length of 32 characters though you may want to consider using 64 characters if security is more important than speed and token size. Generating a strong random secret and securing it is up to you.

Weak RSA Keys

Weak keys can be cracked as well. This library requires a minimum key length of 2048 bits. You may want to consider a key length of 4096 bits depending on your security requirements. Securing your keys is up to you.

Alg None Bypass

The alg=none signature-bypass vulnerability is mitigated by requiring a single valid algorithm. Additional protection exists within the firebase/php-jwt library which should be kept up to date.

RS/HS256 public key mismatch vulnerability

Mitigated by requiring a single valid algorithm. Additional protection exists within the firebase/php-jwt library which should be kept up to date.