sop / jwx
A PHP library for JSON web tokens (JWT) with signature (JWS) and encryption (JWE) support.
Installs: 127 509
Dependents: 4
Suggesters: 0
Security: 0
Stars: 24
Watchers: 2
Forks: 6
Open Issues: 0
Requires
- php: >=7.2
- ext-hash: *
- ext-openssl: *
- sop/aes-kw: ^3.0.0
- sop/crypto-encoding: ^0.3.0
- sop/crypto-types: ^0.3.0
- sop/gcm: ^3.0.0
Requires (Dev)
- ietf-jose/cookbook: *
- phpunit/phpunit: ^8.1
README
A PHP library for JSON web tokens (JWT) with signature (JWS) and encryption (JWE) support.
Also implements unencoded payload option (RFC 7797).
Features
- Signing and signature validation (JWS)
- HMAC, RSA and EC
- Encryption and decryption with compression and integrity protection (JWE)
- AES
- Claims validation
- Configurable with sensible defaults
- JSON Web Keys (JWK)
- Convert PEM encoded keys to JWK and vice versa
Supported algorithms
- Signature
- HMAC with SHA-256, SHA-384 and SHA-512
- RSASSA-PKCS1-v1_5 with SHA-256, SHA-384 and SHA-512
- ECDSA with P-256, P-384 and P-521 curves
- Content encryption
- AES-CBC with 128, 192 and 256-bit key sizes
- AES-GCM with 128, 192 and 256-bit key sizes
- Key management
- Shared symmetric key (direct)
- RSAES-PKCS1-v1_5
- RSAES OAEP
- AES Key Wrap with 128, 192 and 256-bit key sizes
- AES-GCM key encryption with 128, 192 and 256-bit key sizes
- Password-based key encryption (PBES2 with AES Key Wrap)
- Compression
- DEFLATE
Requirements
- PHP >=7.2
- openssl
- hash
- sop/crypto-types
- sop/crypto-encoding
- sop/aes-kw
- sop/gcm
Installation
This library is available on Packagist.
composer require sop/jwx
Usage
Claims
class holds Claim
objects that represent the claims.
The claims shall be encoded into a JWT which may further be
signed or encrypted, producing a JWS or a JWE respectively.
JWS and JWE may also be used to carry arbitrary payload, not just JSON claims.
Code examples
Simple JWT
Parse JWT from https://jwt.io/ HS512 example.
$jwt = new JWT($token); // create context for the claims validation // 'your-512-bit-secret' key is used to verify the signature $ctx = ValidationContext::fromJWK( SymmetricKeyJWK::fromKey('your-512-bit-secret')); // validate claims $claims = $jwt->claims($ctx); // print value of the subject claim echo $claims->subject()->value();
Additional Validation
Parse the same token as above but additionally validate subject and admin claims.
$jwt = new JWT($token); // validate that the subject is "1234567890" // validate that the admin claim is true using explicitly provided validator $ctx = ValidationContext::fromJWK( SymmetricKeyJWK::fromKey('your-512-bit-secret'), ['sub' => '1234567890'] )->withConstraint('admin', true, new EqualsValidator()); // validate and print all claims $claims = $jwt->claims($ctx); foreach ($claims as $claim) { printf("%s: %s\n", $claim->name(), $claim->value()); }
More Examples
See /examples
directory for more examples.
- Create a signed JWT
- Consume a signed JWT
- Create an encrypted JWT
- Consume an encrypted JWT
- Create a nested JWT
- Consume a nested JWT
- Encrypt arbitrary data
- Decrypt arbitrary data
License
This project is licensed under the MIT License.