- How do I install adhocore/jwt in a Laravel project?
- Use Composer to install it with `composer require adhocore/jwt`. No additional Laravel service providers or configuration are required—just require the class and instantiate it directly in your middleware or controller.
- Does this library support asymmetric algorithms like RS256 or ES256?
- Yes, it supports RS256 (RSA) and ES256 (ECDSA) alongside HS256. You’ll need to provide the appropriate key pair (public/private) for asymmetric operations, but the library handles the cryptographic operations for you.
- Can I use this for Laravel Sanctum or Passport integration?
- While this library is lightweight and standalone, it’s not a direct replacement for Sanctum or Passport. You’d need to manually handle token validation in middleware and integrate it with Laravel’s auth system, which may require custom logic for session management or token revocation.
- What Laravel versions does adhocore/jwt support?
- The library itself supports PHP 5.6–8.4, so it works with any Laravel version in that range (Laravel 5.6–9.x). However, if you’re using Laravel’s built-in auth features alongside it, ensure your Laravel version aligns with your PHP version.
- How do I validate custom claims (e.g., 'role' or 'department')?
- Use the `beforeValidate` and `afterValidate` hooks to add custom claim validation logic. For example, you can check if a `role` claim exists and matches expected values before allowing token acceptance.
- Is there built-in support for token revocation or short-lived refresh tokens?
- No, this library doesn’t include revocation logic. For production use, implement a blacklist (e.g., Redis) or use short-lived tokens with frequent re-authentication. Refresh tokens would need to be managed externally, such as via a database or cache.
- How do I handle key management for HS256 or RS256?
- Store your secret keys (HS256) or key pairs (RS256) securely, such as in environment variables or a secrets manager like AWS KMS. Avoid hardcoding keys in your codebase, as this poses a security risk. Rotate keys periodically for added security.
- Can I use this library in a serverless environment (e.g., AWS Lambda)?
- Yes, its lightweight design makes it ideal for serverless. Just ensure your Lambda function has access to the required keys (via environment variables or secrets) and handle any cold-start latency during token validation.
- What happens if a token is malformed or expired? Does it throw exceptions?
- The library returns boolean results for validation (e.g., `JWT::validate($token)`). For granular error handling, check the decoded payload or implement custom logic to distinguish between malformed tokens, expired tokens, or other validation failures.
- Are there performance benchmarks for large payloads or high-throughput APIs?
- The library is micro-optimized for speed, but benchmarks depend on your payload size and algorithm. For high-throughput APIs, test with your expected load—especially if using asymmetric algorithms, which are computationally heavier than HS256.