Weave Code
Php Jwt Laravel Package
firebase/php-jwt
Encode and decode JSON Web Tokens (JWT) in PHP per RFC 7519. Supports common signing algorithms, key handling, header access after verification, and clock-skew leeway. Install via Composer; optional sodium_compat for libsodium environments.
PHP package for JWT
Frequently asked questions about Php Jwt
- How do I install firebase/php-jwt in a Laravel project?
- Run `composer require firebase/php-jwt` in your project root. For EdDSA support, add `paragonie/sodium_compat` if your PHP environment lacks libsodium. No Laravel-specific setup is needed beyond Composer installation.
- Which Laravel versions does firebase/php-jwt support?
- The package works with Laravel 8+, 9, and 10. It has no framework-specific dependencies and relies only on PHP 8.0+. Test thoroughly with your Laravel version to ensure compatibility with its HTTP stack.
- Can I use firebase/php-jwt with Laravel Sanctum or Passport?
- Yes. Replace Sanctum/Passport’s default token generation with `JWT::encode()` and validate tokens using `JWT::decode()` in middleware. For Sanctum, extend its `PersonalAccessToken` model to use JWT payloads instead of UUIDs.
- What algorithms does firebase/php-jwt support, and which should I use in production?
- It supports HS256 (symmetric), RS256/PS256 (asymmetric), and EdDSA. Avoid HS256 in production due to key distribution risks. Use RS256 or EdDSA with PKI or JWKS for better security. EdDSA requires libsodium or `paragonie/sodium_compat`.
- How do I handle key rotation or JWKS endpoints in Laravel?
- Use `CachedKeySet` with a PSR-6 cache (e.g., Redis) to fetch and cache JWKS dynamically. Configure it with a PSR-7 HTTP client (like Guzzle) in Laravel’s `config/services.php`. This avoids downtime during key rotation.
- Will firebase/php-jwt work in a serverless environment (e.g., AWS Lambda)?
- Yes, but ensure your Lambda runtime has OpenSSL (for RS256/PS256) and libsodium (for EdDSA). Test token generation/decoding in a staging environment first. Cache decoded tokens in ElastiCache or DynamoDB for performance.
- How do I validate JWT claims like `exp` or `nbf` in Laravel middleware?
- Use `JWT::decode()` with a `Key` object, and catch exceptions like `BeforeValidException` or `ExpiredException`. Laravel middleware can wrap this logic to reject invalid tokens early. Example: `try { JWT::decode($token); } catch (Exception $e) { abort(401); }`
- Are there performance concerns with high token volumes in Laravel?
- Decode operations are lightweight, but caching decoded tokens (e.g., in Redis) can improve throughput. Benchmark under load, especially if using asymmetric algorithms like RS256. Avoid caching sensitive claims like `sub` or `jti`.
- What alternatives exist for JWT in Laravel, and why choose firebase/php-jwt?
- Alternatives include `php-jwt/auth0` or `webtoken/jwt-framework`. firebase/php-jwt stands out for RFC 7519 compliance, minimal dependencies, and support for modern algorithms (EdDSA). It’s also actively maintained and integrates seamlessly with Laravel’s auth stack.
- How do I log or audit failed JWT validations in Laravel?
- Catch exceptions like `SignatureInvalidException` or `TokenExpiredException` in middleware and log them using Laravel’s `Log` facade. Example: `Log::warning('JWT validation failed', ['error' => $e->getMessage()]);`. Use Laravel’s `failed` event for failed login attempts.
Weaver
How can I help you explore Laravel packages today?