Download the PHP package yivoff/jwt-refresh-bundle without Composer

On this page you can find all versions of the php package yivoff/jwt-refresh-bundle. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.

FAQ

After the download, you have to make one include require_once('vendor/autoload.php');. After that you have to import the classes with use statements.

Example:
If you use only one package a project is not needed. But if you use more then one package, without a project it is not possible to import the classes with use statements.

In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
Some PHP packages are not free to download and because of that hosted in private repositories. In this case some credentials are needed to access such packages. Please use the auth.json textarea to insert credentials, if a package is coming from a private repository. You can look here for more information.

  • Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
  • To use Composer is sometimes complicated. Especially for beginners.
  • Composer needs much resources. Sometimes they are not available on a simple webspace.
  • If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
  • Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Please rate this library. Is it a good library?

Informations about the package jwt-refresh-bundle

yivoff/jwt-refresh-bundle

PHP Version Require Latest Stable Version Total Downloads Latest Unstable Version License Tests codecov

Description

This package provides a way to generate "refresh tokens" that users can use to obtain a new authorization token (JWT) when the previous one expires. This is a companion for [lexik/LexikJWTAuthenticationBundle], and it is not usable on its own.

The package does not make any assumptions about the persistence layer for storing the refresh tokens. You can use any backend or library (Mysql, Mongo, Redis, flat-file, etc) as long as there is a service that implements a basic interface provided by the package: RefreshTokenProviderInterface

Tokens are stored with an identifier and a hashed verifier, instead of a plain-text verifier, for added security.

Each refresh-token can only be used once to get a new auth-token. When used, the old refresh-token is deleted, and a new refresh-token is generated.

You should setup the time-to-live for the refresh-tokens to be significantly higher than the time to live of the auth-tokens.

Requirements

Requires PHP 8+, Symfony 5.3+

Installation and Setup

Installation

Token Provider Implementation

This package makes no assumptions about the nature of your token provider. To be able to use it you'll need to implement your own, either a regular Doctrime ORM repository or whatever better suits your project.

You'll need to have a service that implements RefreshTokenProviderInterface, and then on the bundle configuration, on yivoff_jwt_refresh.token_provider_service you'll write down the service ID that the bundle will use for getting/adding/removing tokens.

This service is responsible, directly or indirectly, of mediating with your persistance layer of choice, and should return/accept RefreshTokenInterface instances. Either your application token entity implements this interface directly, or your token-provider adapts between your native entities, and the provided RefreshToken class.

Purgable Provider

Your token provider can additionally implement PurgableRefreshTokenProviderInterface, to have a convenience method to clear up all the stale tokens. This is necessary if you want to use the included purge command

Security integration

On the same firewall where the JWT Authenticator provides with a login check, setup a new guard authenticator provided by this bundle (Yivoff\JwtTokenRefresh\Security\Authenticator).

E.g, for a typical configuration:

Notice the content for firewall.login.guard.authenticators.

Bundle Configuration:

Yaml

XML

Purge command

If symfony/console is installed on your project, and your Token Provider implements PurgableRefreshTokenProviderInterface, you can use a command to delete all the existing tokens that have already expired.

The command can simply be executed by running bin/console yivoff:jwt_refresh:purge_expired_tokens. On non-error conditions, it produces no output.

Usage

On any regular JSON authentication, the bundle will inject a refresh token on a field named as the parameter_name defined on the configuration. A typical request/response would be:

Request

Response

It is not necessary to register a new route for the "refresh" path. To get a new authentication JWT, you simply call the same login path with regular POST call with a HTTP parameter with the same name and value that we received previously:

Events

If you want your application to react to successful or failed refresh attempts (logging, etc.), the library emits events that you can listen to.

Failure

When the refresh attempt fails for whatever reason, the library emits a Yivoff\JwtRefreshBundle\Event\JwtRefreshTokenFailed event.

The event has three public properties:

Success

On success, a Yivoff\JwtRefreshBundle\Event\JwtRefreshTokenSucceeded event is emitted. This simply includes the properties:


All versions of jwt-refresh-bundle with dependencies

PHP Build Version
Package Version
Requires php Version >=8.1
lexik/jwt-authentication-bundle Version ^v2.20.3
symfony/config Version ^6.3|^7.0.0
symfony/dependency-injection Version ^6.3|^7.0.0
symfony/framework-bundle Version ^6.3|^7.0.0
Composer command for our command line client (download client) This client runs in each environment. You don't need a specific PHP version etc. The first 20 API calls are free. Standard composer command

The package yivoff/jwt-refresh-bundle contains the following files

Loading the files please wait ....