Weave Code
Php Jwt Laravel Package
firebase/php-jwt
Encode and decode JSON Web Tokens (JWT) in PHP (RFC 7519). Supports common signing algorithms, header handling, and clock-skew leeway. Simple API with JWT::encode() and JWT::decode() plus Key objects for verification.
PHP package for JWT
Frequently asked questions about Php Jwt
- How do I install firebase/php-jwt in a Laravel project?
- Run `composer require firebase/php-jwt` in your Laravel project directory. For EdDSA support (e.g., Ed25519), also install `paragonie/sodium_compat` via Composer if your PHP environment lacks native libsodium. No additional Laravel-specific setup is required.
- Which Laravel versions does firebase/php-jwt support?
- The package works with Laravel 5.5+ and PHP 7.4+. For Laravel 10+, ensure PHP 8.1+ is used. Test edge cases (e.g., expired tokens) in CI/CD, especially if using older Laravel versions with PHP 7.4.
- Can I use firebase/php-jwt with Laravel Sanctum or Passport?
- Yes. Use it to validate JWTs in Sanctum (SPAs) or Passport (OAuth2) APIs. Replace or extend Laravel’s built-in auth with custom middleware or guards. For example, validate tokens in Sanctum’s `auth` middleware or Passport’s `validateToken` hook.
- What signing algorithms are recommended for production?
- For production, use asymmetric algorithms like **RS256** (RSA) or **ES256** (ECDSA) to avoid hardcoded secrets. Avoid **HS256** unless keys are securely managed (e.g., AWS KMS). EdDSA (Ed25519) is also secure but requires libsodium or `sodium_compat`.
- How do I handle key rotation in Laravel with this package?
- Use the `CachedKeySet` class to manage dynamic key rotation. Store keys in Laravel’s `config` or a secure vault (e.g., HashiCorp Vault). For revocation, pair short-lived tokens (e.g., 15-minute expiry) with a Redis blacklist or database flag.
- Why am I getting a 'SignatureInvalidException' when decoding JWTs?
- This typically means the token was signed with a different key or algorithm than expected. Verify the `Key` object’s algorithm matches the token’s header (e.g., `new Key($secret, 'HS256')`). Check for clock skew by setting `JWT::$leeway = 60` (seconds) if servers have time mismatches.
- How do I decode JWT payloads into Eloquent models in Laravel?
- Decode the JWT with `JWT::decode()`, then map claims (e.g., `sub` for user ID) to Eloquent models. Example: `$user = User::find((array) $decoded->sub)`. For nested claims, cast the decoded object to an array: `$payload = (array) $decoded`.
- Is firebase/php-jwt compatible with Laravel’s built-in JWT auth (e.g., tymon/jwt-auth)?
- No direct compatibility, but you can replace `tymon/jwt-auth` with this package for more control. Use Laravel middleware to validate tokens (e.g., `ValidateJWT`) or extend Laravel’s `AuthGuard` to use `firebase/php-jwt` for encoding/decoding.
- How do I set up EdDSA (Ed25519) signing in Laravel?
- First, install `paragonie/sodium_compat` via Composer. Then encode/decode with the `EdDSA` algorithm: `$jwt = JWT::encode($payload, $key, 'EdDSA')`. Ensure your PHP environment has the `sodium` extension or the compatibility layer.
- What are the performance implications of using firebase/php-jwt in high-traffic APIs?
- The package is optimized for low latency, but asymmetric algorithms (e.g., RS256) add slight overhead compared to symmetric (HS256). For high throughput (e.g., 10K+ RPS), use `CachedKeySet` to reduce key validation latency and monitor token decode failures for anomalies.
Weaver
How can I help you explore Laravel packages today?