Download the PHP package sinbadxiii/phalcon-auth-jwt without Composer

Phalcon JWT Auth

Example micro app sinbadxiii/phalcon-auth-jwt-example

Additional JWT guard for the Phalcon authentication library sinbadxiii/phalcon-auth

Demo

Requirements

Phalcon: ^5

PHP: ^7.4 || ^8.1

Installation

Install via composer

Run the following command to pull in the latest version::

composer require "sinbadxiii/phalcon-auth-jwt"

Add service provider

Configuration

Copy file from config/jwt.php in your folder config and merge your config

Generate secret key

Update the secret value in config jwt.php or JWT_SECRET value in your .env file.

Generate a 32 character secret phrase like here https://passwordsgenerator.net/

Update your User model

Firstly you need to implement the Sinbadxiii\PhalconAuthJWT\JWTSubject contract on your User model, which requires that you implement the 2 methods getJWTIdentifier() and getJWTCustomClaims().

The example below:

Create auth access, for example "jwt"

Set as a guard JWT

Here we are telling the api guard to use the jwt driver, and we are setting the api guard as the default.

We can now use Phalcon Auth with JWT guard.

Add some basic handlers

Example Auth Login Controller

Attach Middleware

Example code for middleware:

and attach:

You should now be able to POST to the login endpoint (e.g. http://0.0.0.0:8000/auth/login) with some valid credentials and see a response like:

There are a number of ways to send the token via http:

Authorization header:

Authorization Bearer eyJ0eXAiOiJKV1QiLC...

Query string param:

http://0.0.0.0:8000/me?token=eyJ0eXAiOiJKV1QiLC...

Exceptions

Methods

Multiple Guards

attempt()

Attempt to authenticate a user via some credentials.

This will return either a jwt or null

login()

Log a user in and return a jwt for them.

user()

Get the currently authenticated user.

If the user is not then authenticated, then null will be returned.

logout()

Log the user out - which will invalidate the current token and unset the authenticated user.

refresh()

Refresh a token, which invalidates the current one

invalidate()

Invalidate the token (add it to the blacklist)

tokenById()

Get a token based on a given user's id.

payload()

Get the raw JWT payload

validate()

Validate a user's credentials

More advanced usage

Adding custom claims

Set the token explicitly

Check token

Checking the token for correctness

Will return true if everything is ok or Exceptions:

• Sinbadxiii\PhalconAuthJWT\Exceptions\TokenExpiredException ('The token has expired')
• Sinbadxiii\PhalconAuthJWT\Exceptions\TokenBlacklistedException ('The token has been blacklisted')
• Sinbadxiii\PhalconAuthJWT\Exceptions\TokenInvalidException

License

The MIT License (MIT). Please see License File for more information.