Weave Code
Php Jose Verifier Laravel Package
facile-it/php-jose-verifier
Validate and verify JWTs (JOSE) with builder-based verifiers geared for OAuth2/OpenID Connect. Create verifiers from issuer metadata (issuer, jwks_uri) and client metadata (client_id/secret), with optional JWK sets for decryption; ext-gmp recommended for speed.
JOSE JWT verifiers for OAuth2 and OpenID tokens
Frequently asked questions about Php Jose Verifier
- How do I integrate Facile JOSE Verifier into Laravel middleware for token validation?
- Use the provided `ValidateToken` middleware by wrapping it in Laravel’s pipeline. Register it globally in `app/Http/Kernel.php` under `$middleware` or apply it to specific routes via `$route->middleware(['validate.token'])` for granular control. The middleware expects verifiers to be bound in the service container.
- Does this package support token revocation (e.g., short-lived tokens or Redis blacklists)?
- No, the package does not natively support token revocation. For short-lived tokens, rely on expiration claims (`exp`). For revocation, implement an external solution like Redis blacklists or OAuth2 introspection endpoints, then validate tokens against these lists before or after verification.
- What Laravel versions and PHP requirements does Facile JOSE Verifier support?
- The package supports Laravel 9+ and requires PHP 8.1+. For older Laravel versions, consider backporting or using a fork, as dependencies like `web-token/jwt-library` may introduce breaking changes. Always check the package’s `composer.json` for exact version constraints.
- How do I configure dynamic issuer metadata for multi-provider OAuth2/OpenID Connect setups?
- Fetch issuer metadata (e.g., from `/openid-configuration`) at runtime and pass it to the builder. Store configurations in a database or cache (e.g., Laravel’s `config('services')`) and dynamically load them when creating verifiers. Example: `$builder = IdTokenVerifierBuilder::create($dynamicIssuerMetadata, $clientMetadata)`.
- What performance impact does `ext-gmp` have, and can I use this package without it?
- `ext-gmp` significantly speeds up cryptographic operations like RSA and ECC. Without it, the package falls back to slower algorithms, which may impact performance in high-throughput environments. Test your production setup with and without `ext-gmp` to assess the trade-off.
- How do I test Facile JOSE Verifier in Laravel, including mocking JWKS and time-based claims?
- Mock `JwksProvider` and `ClockInterface` (PSR-11) for unit tests. Use Laravel’s `Mockery` or PHPUnit to simulate JWKS responses and time-based claims like `nbf` or `exp`. For integration tests, use real tokens from providers like Google or Auth0, leveraging Laravel’s HTTP testing tools.
- Can I use this package for symmetric signing (e.g., client_secret-based tokens) instead of JWKS?
- Yes, provide the `client_secret` in the client metadata, and the builder will automatically configure the verifier for symmetric signing. This is useful for providers that don’t support JWKS or use shared secrets. Example: `$clientMetadata['client_secret'] = 'your-secret-here';`
- What are the alternatives to Facile JOSE Verifier for JWT validation in Laravel?
- Alternatives include `firebase/php-jwt` (simpler but less feature-rich), `league/oauth2-server` (full OAuth2 server/client), and `spomky-labs/oa4mp` (OAuth2/OpenID Connect client). Facile JOSE Verifier stands out for its builder pattern, PSR compliance, and focus on verifier modularity for OAuth2/OpenID flows.
- How do I handle custom claims or extensions in JWT tokens with this package?
- The package provides limited built-in support for custom claims. For extensions, subclass the verifier classes (e.g., `IdTokenVerifier`) and override methods like `validate()` to add custom logic. Alternatively, manually decode the token after verification using `web-token/jwt-library` and inspect claims.
- What error responses should I return for invalid tokens (e.g., 401 vs. 403)?
- Use `401 Unauthorized` for invalid or expired tokens, as they indicate the client lacks valid credentials. Reserve `403 Forbidden` for cases where the token is valid but the user lacks permissions. Log invalid tokens for audit trails, especially in production, to detect potential attacks.
Weaver
How can I help you explore Laravel packages today?