Download the PHP package smskin/laravel-jwt-auth without Composer

JWT Support Module for Laravel Projects

This module allows you to:

• generate a JWT for a user;
• authorize users via JWT (auth gateway).

Installation

Run the following commands:

Generate a random (brute-force resistant) string and store it in the JWT_SECRET_KEY variable in the .env file.

Add the following to the \App\Models\User model:

• the interface \SMSkin\JwtAuth\Contracts\IJwtUser;
• the trait \SMSkin\JwtAuth\Traits\JwtTrait.

Example after editing:

Add a new guard to the auth.php configuration file:

Example after editing:

Configuration

The jwt.php config file contains the following variables:

• core.secret_key — secret key used for signing the JWT. Can be a string of any length;
• access_token.lifetime — access token lifetime (in minutes);
• refresh_token.lifetime — refresh token lifetime (in minutes).

Usage

How It Works

1. In exchange for login and password, the user receives 3 pieces of data: accessToken — a key that allows the service to identify the user; expiresAt — the timestamp when the key expires; refreshToken — a key that allows the user to obtain a new access token.
2. The user sends requests to the service. The middleware auth:jwt is used to identify the user.
3. When the access token expires (either by time or receiving a 401 response), the user calls the refresh API method to exchange the refreshToken for a new accessToken.

Generating an Access Token (JWT)

The JwtTrait includes the generateJwt method, which returns a Request instance consisting of:

• accessToken (string) — the access token;
• expiresAt (Carbon) — the expiration timestamp of the access token;
• refreshToken (string) — the refresh token.

Obtaining a New Access Token via Refresh

The IAuthService interface provides the refreshAccessToken method to exchange a refresh token for a new access token.

Example AuthController