Download the PHP package tinywan/jwt without Composer

On this page you can find all versions of the php package tinywan/jwt. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.

FAQ

After the download, you have to make one include require_once('vendor/autoload.php');. After that you have to import the classes with use statements.

Example:
If you use only one package a project is not needed. But if you use more then one package, without a project it is not possible to import the classes with use statements.

In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
Some PHP packages are not free to download and because of that hosted in private repositories. In this case some credentials are needed to access such packages. Please use the auth.json textarea to insert credentials, if a package is coming from a private repository. You can look here for more information.

  • Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
  • To use Composer is sometimes complicated. Especially for beginners.
  • Composer needs much resources. Sometimes they are not available on a simple webspace.
  • If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
  • Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Please rate this library. Is it a good library?

Example code of tinywan/jwt

Informations about the package jwt

πŸš€ JSON Web Token (JWT) for Webman

Latest Version on Packagist Total Downloads Monthly Downloads Daily Downloads PHP Version Require Ask Zread

δΈ­ζ–‡θ―΄ζ˜Ž

JSON Web Token (JWT) is an open standard (RFC 7519) that defines a compact and self-contained way for securely transmitting information between parties as a JSON object. This token is designed to be compact and secure, making it particularly suitable for Single Sign-On (SSO) scenarios in distributed applications.

Note: Starting from version 1.14.0, secret key length validation has been introduced for security reasons. Versions prior to 1.14.0 did not strictly check key lengths; versions 1.14.0 and above enforce minimum key length requirements.

v2.0.0 Upgrade Guide

v2.0.0 raises the minimum PHP requirement to PHP 8.2+ and drops support for PHP 7.4, 8.0, and 8.1.

Installation

Install via Composer:

Quick Start

Generating a Token

Output (JSON format):

Response Parameters:

Parameter Type Description Example
token_type string Token type Bearer
expires_in int Token expiration duration (seconds) 36000
access_token string Access token XXXXXXXXXXXXXXXXXXXX
refresh_token string Refresh token (used to renew expired access tokens) XXXXXXXXXXXXXXXXXXXX

Supported Methods & APIs

1. Get Current User ID

2. Get All Payload Claims (Custom Fields)

3. Get Specific Claim Value

4. Refresh Token (Exchange Refresh Token for New Access Token)

5. Get Remaining Token Lifetime

6. Single Device Login (SSO)

Disabled by default. To enable, update your configuration file config/plugin/tinywan/jwt/app.php:

Single device login supports defining the client type client (defaults to WEB), such as: MOBILE, APP, WECHAT, WEB, ADMIN, API, OTHER, etc.

7. Get Current User Model (>= 1.2.4)

The 'user_model' configuration option accepts a closure (defaults to returning an empty array). You can customize the return model based on your ORM:

ThinkORM Configuration:

Laravel ORM (Illuminate Database) Configuration:

8. Clear Token (Logout)

Only takes effect when is_single_device is set to true. Supported parameters: MOBILE, APP, WECHAT, WEB, ADMIN, API, OTHER, etc.

9. Custom Client Types

Defaults to WEB.

10. Custom Expiration Time for Access & Refresh Tokens

11. Minimum Key Length Requirements (>= 1.14.0)

Mandatory minimum key length requirements (especially for HS* symmetric algorithms):

Algorithm Minimum Key Length (Bytes) Reference Character Count (UTF-8) Recommended Generation Method
HS256 32 bytes β‰₯ 32 characters bin2hex(random_bytes(32)) β†’ 64 hex chars
HS384 48 bytes β‰₯ 48 characters random_bytes(48)
HS512 64 bytes β‰₯ 64 characters random_bytes(64)

12. Token Error Codes

Signature Algorithms (JWA)

Common signature algorithms include: HS256 (HMAC-SHA256), RS256 (RSA-SHA256), and ES256 (ECDSA-SHA256).

Supported Algorithms List

Note: Only RS256 and ES256 are marked as Recommended.

Symmetric Algorithms

Defaults to HS256 symmetric encryption.
HS256 uses the same secret_key for signing and verification. If the secret key leaks, security is completely compromised. Therefore, HS256 is best suited for centralized authentication where signing and validation are both performed by trusted parties.

Asymmetric Algorithms

RS256 uses an RSA private key for signing and an RSA public key for verification.
Public key exposure causes no security risk as long as the private key remains secure. RS256 allows delegating verification to third-party services by simply providing them the public key.

Key Pair Generation Commands (OpenSSL)

RS512:

RS384:

RS256:

πŸš€ Video Tutorials

Security & Flow

Concepts

Authentication and authorization are critical yet complex topics in software engineering. In many frameworks, handling security accounts for a significant portion of code. JWT helps you handle authentication easily, securely, and in a standardized way without having to reinvent security specifications.

Flow Scenario

Suppose your backend API lives on one domain, and your frontend (SPA or mobile application) lives on another domain. When a user submits credentials (username & password), the API validates them and responds with an access token. The frontend includes this token in the Authorization header (Bearer <token>) on subsequent requests.

Authentication & Authorization Flowchart

image

Token Signing Process

  1. User sends username and password to the authentication server.
  2. The authentication server verifies credentials and generates a JWT Token:
    • Encodes JWT Header and Payload with Base64URL.
    • Signs the token: HMAC-SHA256(SecretKey, Base64UrlEncode(Header) + "." + Base64UrlEncode(Payload)).
  3. Returns base64(header).base64(payload).signature as the token to the client.
  4. Client attaches the token in request headers for subsequent protected API calls.

License

This project is open-sourced software licensed under the Apache-2.0 License.

All versions of jwt with dependencies

PHP Build Version
Package Version
Requires php Version ^8.2
ext-json Version *
workerman/webman-framework Version ^1.2.1||^2.0
firebase/php-jwt Version ^6.8||^7.0
Composer command for our command line client (download client) This client runs in each environment. You don't need a specific PHP version etc. The first 20 API calls are free. Standard composer command

The package tinywan/jwt contains the following files

Loading the files please wait ...