- How do I install strobotti/php-jwk in a Laravel application?
- Install it with composer require strobotti/php-jwk. There is no Laravel service provider, config file, or facade, which is normal for a framework-agnostic utility. You register your own binding in a service provider if you want it injected. Then wrap it in a small adapter class rather than calling it directly from controllers.
- Is strobotti/php-jwk compatible with Laravel 9, 10, and 11?
- The library is framework-agnostic and is expected to run on PHP 8.1+ alongside Laravel 9 through 11. Because it does not register a service provider, there is nothing to conflict with Laravel's bootstrap. Confirm the tested PHP versions in the package's CI matrix before committing, since the available metadata does not list them explicitly.
- Can I verify an RS256 JWT with this package and firebase/php-jwt?
- Yes, that is the typical use case. Use firebase/php-jwt (or lcobucci/jwt) to parse and verify the token, and use this package to convert the JWK from the issuer's JWKS into a PEM or OpenSSL key that the JWT library can consume. You still need to enforce an algorithm allow-list yourself so an attacker cannot downgrade to none or HS256.
- How is strobotti/php-jwk different from firebase/php-jwt or lcobucci/jwt?
- firebase/php-jwt and lcobucci/jwt handle token parsing, claims validation, and signature verification. strobotti/php-jwk handles the key material: parsing JWK and JWKS documents, exporting PEM/DER, and building OpenSSL keys. They complement each other rather than compete, and this package does not replace a JWT library.
- How do I load a remote JWKS document and select a key by kid?
- Parse the JWKS JSON into the package's KeySet model, then select the entry whose kid matches the token header. You are responsible for fetching and caching the document, handling cache expiry, refreshing on an unknown kid, and deciding how to treat duplicate or missing kids. Treat those policies as part of your own code, not the library's.
- Does it support EC (P-256) and Ed25519 keys, or only RSA?
- RSA is the core supported case; EC and OKP/Ed25519 support depends on the release and must be verified against the source and tests. Do not assume support for a given curve or for x5c certificate chains without checking. If you need Ed25519 or ES256, spike it early with a real fixture before building on it.
- How do I convert a JWK into a PEM or OpenSSL key for signing?
- The library exposes conversion helpers that turn a JWK into PEM/DER or an OpenSSL key so PHP's openssl_* functions and JWT libraries can use it. Private parameters are only needed when you are producing signatures, so publish only the public JWK from your own JWKS endpoint. Always strip private members such as d, p, and q before exposing a key externally.
- Is strobotti/php-jwk safe to use in production for security-sensitive apps?
- The main risk is supply chain and longevity rather than correctness: adoption is very low, repository metadata is thin, and there is no confirmed release cadence. Blast radius is small because the package is a thin wrapper around openssl_* and json_decode, so a replacement can be written in a few hundred lines. Pin an exact version, review the diff on upgrade, wrap it behind your own interface, and consider vendoring it.
- How should I wire this package into Laravel's service container and test it?
- Bind a small JwkKeyFactory or JwksResolver in a service provider and inject it into your middleware or guard. That gives you a seam for tests, so you can load a JWKS fixture and assert end-to-end RS256 verification without hitting the network. It also makes swapping the package out trivial if maintenance stalls.
- What are the alternatives if strobotti/php-jwk is abandoned?
- Consider web-token/jwt-framework for a full JOSE stack, firebase/php-jwt or lcobucci/jwt for token handling paired with your own JWK parsing, or actively maintained JWKS client libraries. In many applications the JWK-to-PEM conversion you actually need is a few dozen lines of base64url and OpenSSL code. Weigh that in-house option against the cost of an unmaintained dependency.