- How do I integrate SimpleJWT with Laravel’s built-in authentication (e.g., Sanctum or Passport)?
- SimpleJWT doesn’t include Laravel-specific integrations like Sanctum or Passport, but you can manually extend Laravel’s auth system. Use middleware to verify tokens before API routes, and create a custom JWT guard to replace or augment Laravel’s default auth. For Sanctum/Passport, use SimpleJWT to generate tokens while keeping their session management intact.
- What Laravel versions does SimpleJWT support, and are there any breaking changes?
- SimpleJWT requires PHP 8.0+, but it’s framework-agnostic. It works with any Laravel 8+ version since it doesn’t rely on Laravel-specific features. Breaking changes are rare but tied to PHP updates or RFC compliance. Always check the changelog for algorithm or key management updates.
- Can I use SimpleJWT for encrypted tokens (JWE) in production, or is it only for signing (JWS)?
- Yes, SimpleJWT fully supports JWE (JSON Web Encryption) for encrypted tokens using AES-GCM, RSA-OAEP, or ECDH-ES. It’s production-ready for sensitive data, but ensure your server supports the required PHP extensions (e.g., `openssl`, `sodium`). For APIs, JWE is ideal for confidential claims like PII.
- How do I store and rotate keys securely in Laravel?
- Store keys in Laravel’s encrypted config (e.g., `config/jwt.php`) or an external vault like AWS KMS or HashiCorp Vault. For rotation, use SimpleJWT’s `KeySet` to manage multiple keys and set the `kid` (key ID) claim. Laravel’s config caching can help avoid runtime key lookups. Never hardcode keys in version control.
- Is SimpleJWT compatible with Laravel’s caching system for token claims?
- Yes, you can cache JWT claims (e.g., user roles, permissions) in Laravel’s cache store (e.g., Redis, Memcached) to reduce database lookups. Store the token’s `jti` (JWT ID) as the cache key and the decoded payload as the value. This works well for stateless APIs but requires manual invalidation on token revocation.
- What are the performance implications of using RSA/ECDSA vs. HMAC for Laravel APIs?
- RSA/ECDSA introduces higher CPU overhead than HMAC due to asymmetric cryptography. Benchmark in your Laravel environment—RSA can add 50–200ms per request on shared hosting. For high-traffic APIs, prefer HMAC (HS256) if security policies allow, or use EdDSA (e.g., Ed25519) for a balance of speed and security.
- How do I revoke tokens in a stateless JWT system using Laravel?
- JWTs are stateless by default, so revocation requires a custom solution. Create a `failed_jwt_attempts` table to log revoked tokens (e.g., `jti` + `exp`). Use Laravel middleware to check this table before validating tokens. For short-lived tokens, rely on expiration (`exp` claim) instead.
- Are there alternatives to SimpleJWT for Laravel that offer built-in middleware or Eloquent support?
- Yes, alternatives like `tymon/jwt-auth` or `laravel/sanctum` include Laravel-specific features (e.g., middleware, Eloquent guards). However, SimpleJWT offers broader RFC compliance and advanced algorithms (e.g., JWE, EdDSA). Choose `tymon/jwt-auth` for quick Laravel integration or SimpleJWT for custom or high-security needs.
- How do I test JWT generation/verification in Laravel’s PHPUnit?
- Mock SimpleJWT’s `KeySet` and `JWT` classes in your tests. Use PHPUnit’s `createMock()` to simulate key loading or signing failures. For integration tests, use Laravel’s HTTP tests to verify token validation in middleware. Example: `public function test_jwt_validation() { $response = $this->withHeader('Authorization', 'Bearer ...'); $response->assertStatus(401); }`
- What PHP extensions are required, and how do I enable them in Laravel’s Docker or shared hosting?
- SimpleJWT requires `gmp`, `openssl`, `hash`, and `sodium` (for EdDSA/X25519). In Docker, add them to your `Dockerfile` with `RUN docker-php-ext-install gmp openssl sodium`. For shared hosting, check your provider’s PHP extension list or use a custom PHP build. Verify with `php -m | grep gmp` after setup.