Download the PHP package usefulteam/jwt-auth without Composer
On this page you can find all versions of the php package usefulteam/jwt-auth. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.
FAQ
Example:
In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
- Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
- To use Composer is sometimes complicated. Especially for beginners.
- Composer needs much resources. Sometimes they are not available on a simple webspace.
- If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
- Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Informations about the package jwt-auth
JWT Auth
WordPress JWT (JSON Web Token) Authentication allows you to do REST API authentication via token. It's a simple, non-complex, and easy to use.
This plugin probably is the most convenient way to do JWT Authentication in WordPress. Download it from WordPress plugin page.
- Support & question: WordPress support forum
- Reporting plugin's bug: GitHub issues tracker
- Discord channel also available.
Requirements
PHP
Minimum PHP version: 7.2
Enable PHP HTTP Authorization Header
Shared Hosts
Most shared hosts have disabled the HTTP Authorization Header by default.
To enable this option you'll need to edit your .htaccess file by adding the following:
WPEngine
To enable this option you'll need to edit your .htaccess file by adding the following (see this issue):
Installation
Through the WordPress Administrative Area:
- From WordPress administrative area, go to Plugins -> Add New
- Search for JWT Auth
- Install it
- Easily configure it (see Configuration below)
- and then activate it
Download Manually:
- Download the plugin from WordPress plugins page
- Upload to your wp-content directory
- Easily configure it (see Configuration below)
- Activate it from Plugins menu in admin area
Configuration
Configurate the Secret Key
The JWT needs a secret key to sign the token. It must be unique and never be revealed.
To add the secret key, edit your wp-config.php file and add a new constant called JWT_AUTH_SECRET_KEY.
You can use a string from here https://api.wordpress.org/secret-key/1.1/salt/
Configurate CORs Support
This plugin has the option to enable CORs support.
To enable the CORs Support edit your wp-config.php file and add a new constant called JWT_AUTH_CORS_ENABLE
Finally activate the plugin within the plugin dashboard.
Namespace and Endpoints
When the plugin is activated, a new namespace is added.
Also, three new endpoints are added to this namespace.
| Endpoint | HTTP Verb |
|---|---|
| /wp-json/jwt-auth/v1/token | POST |
| /wp-json/jwt-auth/v1/token/validate | POST |
| /wp-json/jwt-auth/v1/token/refresh | POST |
Requesting/ Generating Token
/wp-json/jwt-auth/v1/token
To generate token, submit a POST request to this endpoint. With username and password as the parameters.
It will validates the user credentials, and returns success response including a token if the authentication is correct or returns an error response if the authentication is failed.
You can use the optional parameter device with the device identifier to let user manage the device access in your profile. If this parameter is empty, it is ignored.
Sample of success response when trying to generate token:
Sample of error response when trying to generate token:
Once you get the token, you must store it somewhere in your application. It can be:
- using cookie
- or using localstorage
- or using a wrapper like localForage or PouchDB
- or using local database like SQLite or Hive
- or your choice based on app you develop ;)
Then you should pass this token as Bearer Authentication header to every API call. The header format is:
Authorization: Bearer your-generated-token
and here's an example:
The jwt-auth will intercept every call to the server and will look for the authorization header, if the authorization header is present, it will try to decode the token and will set the user according with the data stored in it.
If the token is valid, the API call flow will continue as always.
Validating Token
You likely don't need to validate the token your self. The plugin handle it for you like explained above.
But if you want to test or validate the token manually, then send a POST request to this endpoint (don't forget to set your Bearer Authorization header):
/wp-json/jwt-auth/v1/token/validate
Valid Token Response
Refreshing the Access Token
For security reasons, third-party applications that are integrating with your authentication server will not store the user's username and password. Instead they will store the refresh token in a user-specific storage that is only accessible for the user. The refresh token can be used to re-authenticate as the same user and generate a new access token.
When authenticating with username and password as the parameters to /wp-json/jwt-auth/v1/token, a refresh token is sent as a cookie in the response.
/wp-json/jwt-auth/v1/token
To generate new access token using the refresh token, submit a POST request to the token endpoint together with the refresh_token cookie.
Use the optional parameter device with the device identifier to associate the token with that device.
If the refresh token is valid, then you receive a new access token in the response.
By default, each access token expires after 10 minutes.
/wp-json/jwt-auth/v1/token/refresh
To generate new refresh token using the refresh token, submit a POST request to the token refresh endpoint together with the refresh_token cookie.
Use the optional parameter device with the device identifier to associate the refresh token with that device.
If the refresh token is valid, then you receive a new refresh token as a cookie in the response.
By default, each refresh token expires after 30 days.
Refresh Token Rotation
Whenever you are authenticating afresh or refreshing the refresh token, only the last issued refresh token remains valid. All previously issued refresh tokens can no longer be used.
This means that a refresh token cannot be shared. To allow multiple devices to authenticate in parallel without losing access after another device re-authenticated, use the parameter device with the device identifier to associate the refresh token only with that device.
Error Responses
If the token is invalid an error will be returned. Here are some samples of errors:
No Secret Key
No HTTP_AUTHORIZATION Header
Bad Iss
Invalid Signature
Incomplete Payload
User Not Found
Expired Token
Obsolete Token
Invalid Refresh Token
Obsolete Refresh Token
Expired Refresh Token
Available Filter Hooks
JWT Auth is developer friendly and has some filters available to override the default settings.
jwt_auth_cors_allow_headers
The jwt_auth_cors_allow_headers allows you to modify the available headers when the CORs support is enabled.
Default Value:
Usage example:
jwt_auth_authorization_header
The jwt_auth_authorization_header allows you to modify the Authorization header key used to validating a token. Useful when the server already uses the 'Authorization' key for another auth method.
Default value:
Usage example:
jwt_auth_iss
The jwt_auth_iss allows you to change the iss value before the payload is encoded to be a token.
Default Value:
Usage example:
jwt_auth_not_before
The jwt_auth_not_before allows you to change the nbf value before the payload is encoded to be a token
Default Value:
Usage example:
jwt_auth_expire
The jwt_auth_expire allows you to change the exp value before the payload is encoded to be a token
Default Value:
Usage example:
jwt_auth_refresh_expire
The jwt_auth_refresh_expire filter hook allows you to change the expiration date of the refresh token.
Default Value:
Usage example:
jwt_auth_alg
The jwt_auth_alg allows you to change the supported signing algorithm for your application.
Default Value:
Usage example:
jwt_auth_payload
The jwt_auth_payload allows you to modify all the payload / token data before being encoded and signed.
Default value:
Usage example:
jwt_auth_valid_credential_response
The jwt_auth_valid_credential_response allows you to modify the valid credential response when generating a token.
Default value:
Usage example:
jwt_auth_valid_token_response
The jwt_auth_valid_token_response allows you to modify the valid token response when validating a token.
Default value:
Usage example:
jwt_auth_extra_token_check
The jwt_auth_extra_token_check allows you to add extra criterias to validate the token. If empty, has no problem to proceed. Use empty value to bypass the filter. Any other value will block the token access and returns response with code jwt_auth_obsolete_token.
Default value:
Usage example:
Automated Tests
There are end-to-end tests you can run to confirm that the API works correctly:
Credits
- PHP-JWT from firebase
- JWT Authentication for WP REST API. This JWT-Auth plugin was a "copy-then-modify" of JWT Authentication for WP REST API plugin.
- Devices utility by pesseba
- The awesome maintainers and contributors
License
Keep This Plugin Alive & Maintained
You can help us to keep this plugin alive and continue to maintain it by:
- Giving 5 Stars review here
- Answering GitHub issues or questions on Discord.
- Testing / participating to the submitted PRs
Thank You!
