Php Jwt Laravel Package
firebase/php-jwt
Encode and decode JSON Web Tokens (JWT) in PHP per RFC 7519. Supports common signing algorithms, key handling, and optional leeway for clock skew. Install via Composer; libsodium compatible via sodium_compat.
Bug Fixes
- remove resource support (#612)
7.0.0 (2025-12-15)
⚠️ ⚠️ ⚠️ Security Fixes ⚠️ ⚠️ ⚠️
- add key size validation (#613) (6b80341) NOTE: This fix will cause keys with a size below the minimally allowed size to break.
Features
- add SensitiveParameter attribute to security-critical parameters (#603) (4dbfac0)
- store timestamp in
ExpiredException(#604) (f174826)
Bug Fixes
Features
-
Added
Cached Key Sets(#397)!! See the README for usage instructions -
Added
$defaultAlgparameter toJWT::parseKeyandJWT::parseKeySet(#426). This will allow users to parse JWKS which do not populate thealgparameter without having to manually edit the JSON.
Bug Fix
- revert the flag to json_decode to force object (https://github.com/firebase/php-jwt/pull/420)
Note: This fixes the PHP Fatal error the previous version tried to fix, but does so in a safer way.
Bug Fixes
Add flag to json_decode to force object (#416)
Note: This technically breaks backwards compatibility, but it fixes a PHP Fatal error in the current release on JWT::decode which also broke backwards compatibility, so we hope it's justified 🤞
Note: There should be no issues with backwards compatibility unless types were being used incorrectly
- This version is compatible with PHP >= 7.1
- Drop support for PHP 5.3, 5.4, 5.5, 5.6, and 7.0
- Add parameter typing and return types
- Better PHPDoc / IDE support
Note: This version is compatible with PHP >= 5.3
Backwards Compatibility Breaking Changes
- The second argument of
JWT::decodenow must beFirebase\JWT\Keyorarray<string, Firebase\JWT\Key>(see #376) - The return type of
Firebase\JWT\JWK::parseKeyis nowFirebase\JWT\Key(see #392) - The return type of
Firebase\JWT\JWK::parseKeySetis nowarray<string, Firebase\JWT\Key>(see #376) - The "alg" parameter is required to be set for all JWKS parsed using
Firebase\JWT\JWK::parseKeySet(see #376) - The flag
JSON_UNESCAPED_SLASHESis now used for JSON decoding (see #376) - Constants
ASN1_INTEGER,ASN1_SEQUENCE, andASN1_BIT_STRINGhave been removed (see #376) JWT::encoderequires third argument$alg(see #377)JWT::signrequires third argument$alg(see #377)
Using Firebase\JWT\Key
Using the Key object in JWT::decode
As a security fix, to avoid key type confusion (see #351), use of Firebase\JWT\Key is now required when decoding:
use Firebase\JWT\JWT;
// previous (v5.5.1 and below)
$decoded = JWT::decode($jwt, $publicKey, 'RS256');
// new (v6.0.0)
use Firebase\JWT\Key;
$decoded = JWT::decode($jwt, new Key($publicKey, 'RS256'));
And when you have more than one key, the second argument can be an array of Key objects:
use Firebase\JWT\JWT;
// previous (v5.5.1 and below)
$decoded = JWT::decode($jwt, [$publicKey1, $publicKey2], 'RS256');
// new (v6.0.0)
use Firebase\JWT\Key;
$decoded = JWT::decode($jwt, [
'kid1' => new Key($publicKey1, 'RS256'),
'kid2' => new Key($publicKey2, 'RS256')
]);
Note: When providing multiple keys, you must provide the matching $kid as the fourth parameter
to the JWT::encode function
Using the Key object in JWK::parseKey and JWK::parseKeySet
Calls to JWK::parseKey and JWK::parseKeySet now return a Key object and an array
of Key objects respectively.
use Firebase\JWT\JWK;
// previous (v5.5.1 and below)
$key = JWK::parseKey($jwk); // $key is a resource
$keys = JWK::parseKeySet($jwks); // $keys is an associative array key ID to resources
// new (v6.0.0)
$key = JWK::parseKey($jwk); // $key is a Key object
$keys = JWK::parseKeySet($jwks); // $keys is an associative array of key ID to Key objects
If the keys in your JWKS do not contain the "alg", you need to set it manually to the expected algorithm, for it to be able to parse successfully:
// new (v6.0.0) for JWKS which do not contain "alg"
foreach ($jwks as $k => $jwks) {
$jwks[$k]['alg'] = 'RS256'; // the expected alg of your JWKS
}
$keys = JWK::parseKeySet($jwks); // $keys is an associative array of key ID to Key objects
Bug Fixes
This release fixes BC issues caused by the changes in 5.5.0:
- Updates PHPDoc for static analyzers (#371)
- Ensures exceptions are not thrown for keys of type
resourceorOpenSSLAsymmetricKey(#371)
!!IMPORTANT!!
The recommended usage of this library has changed.
A Key object should now be used as the second argument to JWT::decode instead of using the
allowed_algs array. This will prevent key/algorithm type confusion:
// Previous way to call "decode"
Firebase\JWT\JWT::decode($jwt, $publicKey, ['RS256']);
// New (safer) way to call "decode"
$key = new Firebase\JWT\Key($publicKey, 'RS256');
Firebase\JWT\JWT::decode($jwt, $key);
Please see #351 for more information on the issue, and #365 for the merged changes.
The README has also been updated to reflect the new usage.
Features
- add Ed25519 support to JWT (#343)
- make JWK::parseKey public (#337)
Bug Fixes
- export-ignore github dir (#338)
Features
- add ES384 support (#324)
Bug Fixes
- allow for null d values in RSA JWK (#330)
Bug Fixes
- fix: add missing use statement in JWK (#303)
Features
- JWK support (#273)
Bug Fixes
- Backslashes for native function invocations (#284)
How can I help you explore Laravel packages today?