nowakowskir / php-jwt
JSON Web Token implementation for PHP.
Installs: 179 544
Dependents: 9
Suggesters: 0
Security: 0
Stars: 37
Watchers: 4
Forks: 17
Open Issues: 4
Requires
- php: >=7.2.1
Requires (Dev)
- phpunit/phpunit: ^7.5|^8.0
README
JWT
Read more about JWT here:
License
Please check BSD-3 Clause terms before use.
Supported algorithms
- HS256
- HS384
- HS512
- RS256
- RS384
- RS512
Installation
You can add this package to your project by running composer command:
composer require nowakowskir/php-jwt
Make sure your vendor auto load file is loaded correctly and the following classes are used.
use Nowakowskir\JWT\JWT;
use Nowakowskir\JWT\TokenDecoded;
use Nowakowskir\JWT\TokenEncoded;
Elements
When using this package, you will be mostly using two classes: TokenEncoded
and TokenDecoded
.
You can transform objects of those class like below:
TokenEncoded => TokenDecoded
TokenDecoded => TokenEncoded
TokenDecoded
This class is a representation of a decoded token. It consists of a header and payload. Both elements are arrays.
Token represented by an object of TokenDecoded
class lets you access and modify any of its parts.
TokenEncoded
This class is a representation of an encoded token.
Usage
Building the new JWT
There are two arguments you can optionally pass to TokenDecode
constructor. These are payload and header.
$tokenDecoded = new TokenDecoded(['payload_key' => 'value'], ['header_key' => 'value']);
$tokenEncoded = $tokenDecoded->encode($privateKey, JWT::ALGORITHM_RS256);
echo 'Your token is: ' . $tokenEncoded->toString();
Please check Security best practices section to understand why providing algorithm is mandatory when encoding a token!
Instantiating existing token
$tokenEncoded = new TokenEncoded('Existing JSON Web Token');
Getting token's header
$tokenEncoded = new TokenEncoded('Existing JSON Web Token');
$header = $tokenEncoded->decode()->getHeader();
Getting token's payload
$tokenEncoded = new TokenEncoded('Existing JSON Web Token');
$payload = $tokenEncoded->decode()->getPayload();
Please note that providing a key is not required to decode a token, as its header and payload are public. You should put special attention to not pass any confidential information within the token's header and payload. JWT only allows you to verify if the token containing the given payload was issued by a trusted party. It does not protect your data passed in a payload! Be aware anybody can access your token's payload!
Validating token
In order to use a decoded payload make sure your token goes through validate process first. Otherwise, payload can't be assumed as trusted!
try {
$tokenEncoded->validate($publicKey, JWT::ALGORITHM_RS256);
} catch(Exception $e) {
// Token validation failed.
}
Please check the the Security best practices section to understand why providing an algorithm is mandatory when validating a token!
If you need more detailed information about why your validation process has failed, there are several exception classes you can catch:
Building the new JWT with expiration date (exp)
If you want your token to expire at some date, you can use exp
flag.
$tokenDecoded = new TokenDecoded(['exp' => time() + 1000]);
$tokenEncoded = $tokenDecoded->encode($key, JWT::ALGORITHM_RS256);
Building the new JWT with not before date (nbf)
If you want your token to be not active until reach some date, you can use nbf
flag.
$tokenDecoded = new TokenDecoded(['nbf' => time() + 1000]);
$tokenEncoded = $tokenDecoded->encode($key, JWT::ALGORITHM_RS256);
Solving clock difference issue between servers (exp, nbf)
Because the clock may vary across the servers, you can use so-called leeway
to solve this issue. It's some kind of time margin which will be taken into account when validating token (exp, nbf).
$leeway = 500;
$tokenEncoded = new TokenEncoded('Existing JSON Web Token');
$tokenEncoded->validate($key, JWT::ALGORITHM_RS256, $leeway);
Security best practices
Don't pass confidential data in token's payload
Please note that providing a key is not required to decode a token, as its header and payload are public. You should put special attention to not pass any confidential information within the token's header and payload. JWT only allows you to verify if the token containing the given payload was issued by a trusted party. It does not protect your data passed in a payload! Be aware anybody can access your token's payload!
Don't trust your payload until you validate a token
The only way to ensure the token is valid is to use TokenEncoded::validate()
method. Please keep in mind that TokenDecoded::decode()
method decodes a token only. It gives you access to its payload without any validation!
The reason why it allows you to get the token's payload without any validation is that:
- it's a nature of JWT that token's payload is not encrypted and is not protected by keys, so you should not even have illusion it is protected,
- you may need to use some parts of your token's payload before token validation.
Enforce algorithm when encoding and validating token
As in some circumstances, the algorithm defined in token's header may be modified by an attacker, it's highly recommended to not rely on the algorithm contained in token's header.
Due to security reasons you should choose one algorithm whenever possible and stick to it in both issuer and verifier applications.
To increase your tokens' security, this package requires an algorithm to be provided when encoding and validating tokens.
Below you can find correct way of encoding and decoding tokens:
// Issuer
$tokenDecoded = new TokenDecoded();
$tokenEncoded = $tokenDecoded->encode($privateKey, JWT::ALGORITHM_RS256);
// Consumer
$tokenEncoded->validate($publicKey, JWT::ALGORITHM_RS256);
As you can see, both use the same algorithm.
This package throws Nowakowskir\JWT\Exceptions\AlgorithmMismatchException
if the algorithm you decided to use to validate the token is different from the algorithm specified in the token's header.
This protects your token against successful validation in case the token has been tampered.
You may be tempted to do some workaround and use the algorithm contained in the token's header for validation purposes, although it's highly not recommended!
// Don't use algorithm defined in token's header like here!
$header = $tokenEncoded->decode()->getHeader();
$tokenEncoded->validate($publicKey, $header['alg']);
Using insecure tokens
Creating insecure tokens is not possible due to security reasons.
This package does not let you create a token with none
algorithm or empty signature.
Trying to do so will result in Nowakowskir\JWT\Exceptions\InsecureTokenException
exception.
try {
$tokenEncoded = new TokenEncoded('Existing JSON Web Token with none algorithm or missing signature');
} catch (InsecureTokenException $e) {
// Insecure token
}
try {
$tokenDecoded = new TokenDecoded();
$tokenDeoded->encode($privateKey, 'none');
} catch (InsecureTokenException $e) {
// Insecure token
}
It's also not possible to parse token without an algorithm defined.
try {
$tokenEncoded = new TokenEncoded('Existing JSON Web Token without an algorithm');
} catch (UndefinedAlgorithmException $e) {
// Algorithm not provided
}
Generate a strong private key
First, you need to generate a private key.
ssh-keygen -t rsa -b 4096 -m PEM -f private.key
chmod 600 private.key
Next, you need to generate a public key based on the private key.
openssl rsa -in private.key -pubout -outform PEM -out public.pub
Rotate your public/private key pair regularly
To minimize the risk of gaining your public/private key by an unauthorized entity, rotate it regularly.
Protect your private key
Make sure your private key is secured and not accessible by any unauthorized entities. Special care should be taken to file permissions. In most cases, you should set 600
permissions on your private key file, which means it's accessible only by the file's owner.
Protect your public key
Even if it's called public, try to share this key only when it's really required. Also, file permissions should be as restrictive as possible. Do not pass public keys between requests or expose them to the public audience.
Don't pass tokens in URL
They will be stored in server logs, browser history, etc.
Use token's expiration date
Whenever possible, use the token's expiration date, so the token is valid as short as necessary.
Check for updates
Regularly check for updates of this package.