Weave Code
Php Jwt Laravel Package
firebase/php-jwt
A simple PHP library to encode and decode JSON Web Tokens (JWT), conforming to RFC 7519. Specify supported algorithms, verify tokens with Key objects, and set leeway for clock skew between servers.
PHP package for JWT
Frequently asked questions about Php Jwt
- What is firebase/php-jwt used for in Laravel?
- firebase/php-jwt is a PHP library for encoding and decoding JSON Web Tokens per RFC 7519. In Laravel it fits token-based authentication and API security, including custom guards, Sanctum, or Passport integrations. You use it to generate signed tokens and verify incoming tokens before trusting their claims.
- How do I install firebase/php-jwt in a Laravel project?
- Install it with Composer by running composer require firebase/php-jwt in your Laravel project. If your PHP environment lacks libsodium and you need EdDSA, also install paragonie/sodium_compat. Add phpseclib/phpseclib only if you need PS256 support.
- Does firebase/php-jwt work with Laravel Sanctum and Passport?
- Yes, it can work with Laravel Sanctum, Passport, or custom guards because it has no framework-specific dependencies. The package handles JWT encoding and decoding while Laravel handles request flow, middleware, and user resolution. You typically wrap token verification in a service or middleware and then authenticate the resolved user.
- Which signing algorithms does firebase/php-jwt support?
- It supports common JWT algorithms including HS256, RS256, PS256, and EdDSA. RS256 and PS256 require OpenSSL, PS256 also needs phpseclib, and EdDSA needs libsodium or paragonie/sodium_compat. Choose symmetric HS256 only when both signing and verifying parties can safely share the secret.
- How do I decode a JWT and access headers with firebase/php-jwt?
- After verifying a token with JWT::decode, pass a stdClass as the third parameter to receive the decoded header values. The library intentionally does not support reading headers before verification because unverified header data can be tampered with. Always verify the signature first, then inspect header fields such as alg or kid if needed.
- How do I handle JWT expiration and clock skew in Laravel?
- Set JWT::$leeway to a small number of seconds, such as 60, to tolerate clock skew between signing and verifying servers. Also validate claims like exp, nbf, iss, and aud to prevent replay or misuse. Keep leeway to a few minutes rather than a large window.
- Can firebase/php-jwt validate JWKS and rotating keys?
- Yes, the package supports JWKS, cached key sets, and multi-key validation for dynamic key rotation scenarios. CachedKeySet can use a PSR-6 cache and a PSR-7 compatible HTTP client, which fits Laravel cache drivers and Guzzle. This helps avoid downtime when identity providers rotate signing keys.
- What exceptions should I catch for invalid JWTs?
- Catch exceptions such as SignatureInvalidException and ExpiredException when JWT validation fails. Log or audit these failures according to your security requirements instead of exposing raw token errors to clients. Returning a generic unauthorized response is usually safer for API consumers.
- Is firebase/php-jwt suitable for production Laravel APIs?
- It is suitable for production Laravel APIs when you configure algorithms, keys, claims, and error handling correctly. Use asymmetric keys when you need public-key verification, validate all security-relevant claims, and benchmark decode calls under expected load. For high-volume APIs, consider caching decoded results or key sets and monitor PHP and OpenSSL deprecations.
- What PHP and Laravel versions does firebase/php-jwt support?
- The package supports PHP 8.0+ and works with Laravel 8+ according to the evaluation, with no framework-specific dependencies. Laravel 9 and 10 are common targets, but you should test against your exact PHP and Laravel versions. Check your crypto extensions, especially OpenSSL and libsodium, before choosing algorithms.
Weaver
How can I help you explore Laravel packages today?