arrow-web-sol/laravel-jwt-auth

Authenticate users via JWT in Laravel.

v0.6.1 2024-07-04 10:10 UTC

Requires

• php: 8.0.*|8.1.*|8.2.*
• illuminate/auth: ^9.0|^10.0|^11.0
• illuminate/contracts: ^9.0|^10.0|^11.0
• illuminate/http: ^9.0|^10.0|^11.0
• illuminate/support: ^9.0|^10.0|^11.0
• lcobucci/jwt: ^4.3
• nesbot/carbon: ^2.64|^3.0
• ramsey/uuid: ^4.7
• spatie/laravel-package-tools: ^1.13

Requires (Dev)

• larastan/larastan: ^2.0.1
• nunomaduro/collision: ^6.0|^7.0|^8.0
• orchestra/testbench: ^7.0|^8.0|^9.0
• pestphp/pest: ^1.21|^2.0
• pestphp/pest-plugin-laravel: ^1.1|^2.0
• phpseclib/phpseclib: ^3.0
• phpstan/extension-installer: ^1.1
• phpstan/phpstan-deprecation-rules: ^1.0
• phpstan/phpstan-phpunit: ^1.0
• phpunit/phpunit: ^9.5|^10.0|^11.0
• spatie/laravel-ray: ^1.26

MIT

• Arron King

• Authentication
• laravel
• jwt
• Arrow Web Solutions

README

A simple method to authenticate users in Laravel via a JWT - http://jwt.io

A bearer token is taken from the request, this token is then checked using the configured JWT algorithm. If the token is deemed valid, the the request is "authenticated". This package will check to ensure the token was signed using an appropriate key and is valid at the time of the request (iat, nbf and exp claim checks).

A common use case is in authentication in Laravel micro-services. Your auth service (Passport for example) can issue a JWT on successful login. Your other services can then use this package to authenticate requests without touching your auth service. Because a JWT is cryptographicaly signed you can verify the token originated from your auth service and hasn't been tampered with.

Installation

composer require arrow-web-sol/laravel-jwt-auth

Then run

php artisan jwt-auth:publish:config

That creates a jwt-config.php config file, in here you can set the signing method used, hash used, key (hmac only) and the public key (rsa and ecdsa). The key or public key is used to verify the JWT.

NOTE: the jwt-config.php is merged into auth.php as part of the service provider boot process. It adds a guard and provider for 'jwt', which in most cases will never be set nor used. But if you do have a 'jwt' guard and or provider in your auth.php file then be aware this package will override that key.

Middleware

To protect routes, you can now use 'auth:jwt':

Route::middleware('auth:jwt')->get('/user', [UserController::class, 'index']);

Or, to set default auth method, edit config/auth.php

	    'defaults' => [
        	'guard' => 'jwt',

The package needs the token to be sent as a bearer token in the authorization header.

Testing

You can use the normal Laravel test methods:

//if jwt isn't your default guard
$this->actingAs($user, 'jwt');

//if jwt is your default guard
$this->actingAs($user);

Although we do this as part of our test suite, you can test the full token flow:

//NOTE: You need the private key set in config to do this for asymetric signatures
$jwtConfig = $this->app()->make(\Arrow\JwtAuth\Contracts\JwtConfiguration::class);

$token = $jwtConfig
    ->builder()
    ->issuedBy('https://arrow-web.dev')
    ->permittedFor('https://example.com')
    ->identifiedBy(Str::random(12))
    ->issuedAt(now()->toDateTimeImmutable())
    ->canOnlyBeUsedAfter(now()->toDateTimeImmutable())
    ->expiresAt(now()->addHour()->toDateTimeImmutable())
    ->withClaim('claim-name', 'claim-value')
    ->getToken($jwtConfig->signer(), $jwtConfig()->signingKey());

$this->withToken($token->toString())
    ->getJson('/user')
    ->assertSuccessful();