- How do I install libJWT in a Laravel project?
- Use Composer to install it with `composer require beyondbluesky/lib-jwt`. Since it’s a standalone PHP library, no Laravel-specific setup is required, but you’ll need to manually integrate it with your auth system (e.g., middleware or guards).
- Does libJWT support Laravel’s Sanctum or Passport for OAuth2?
- No, libJWT is a generic JWT library and lacks built-in Laravel integrations like Sanctum or Passport. You’ll need to create custom middleware or guards to bridge it with Laravel’s auth system, which may require additional development effort.
- What JWT algorithms (e.g., RS256, HS256) does libJWT support?
- The package’s README doesn’t explicitly list supported algorithms, but it claims PHP 8.4 compatibility. Check the source code or test with your required algorithms (e.g., RS256 for OAuth2) before adoption, as unsupported algorithms could break security.
- Can I use libJWT for production APIs with strict security requirements?
- Proceed with caution. The package has low adoption (no stars/dependents) and no visible security audit trail. For production, prefer `firebase/php-jwt` (Laravel’s default) or `tymon/jwt-auth`, which have better security track records and Laravel-specific safeguards.
- How do I validate JWT tokens in Laravel middleware with libJWT?
- Create a custom middleware (e.g., `ValidateJWT`) that uses `libJWT` to decode and verify tokens. Manually check claims (e.g., `exp`, `iss`) and bind the payload to Laravel’s auth system if needed, as the library doesn’t integrate with Laravel’s guards or facades.
- Does libJWT handle token revocation or key rotation?
- No, libJWT doesn’t include revocation lists or key rotation logic. For Laravel, you’d need to implement this manually (e.g., store blacklisted tokens in the database/cache and validate against them in middleware).
- Is libJWT faster than firebase/php-jwt for Laravel APIs?
- There are no public benchmarks comparing libJWT to `firebase/php-jwt`. Since both are lightweight, performance differences are likely minimal, but test your specific use case (e.g., high-throughput APIs) if speed is critical.
- Will libJWT work with Laravel’s Auth facade or User model?
- No, libJWT is agnostic to Laravel’s auth system. You’ll need to manually map decoded JWT payloads (e.g., `sub` claim) to Laravel users, possibly by extending the `User` model or creating a custom guard.
- Are there alternatives to libJWT for Laravel JWT auth?
- Yes. For Laravel, use `tymon/jwt-auth` (mature, Laravel-aware) or `firebase/php-jwt` (standard). For non-Laravel PHP projects, libJWT might suffice if you prioritize simplicity over Laravel-specific features.
- How do I test libJWT in a Laravel project before full deployment?
- Start by testing token encoding/decoding in a non-critical API endpoint. Use PHPUnit to validate edge cases (e.g., malformed tokens, expired claims). Gradually replace token logic in controllers/services, ensuring backward compatibility with existing tokens.