Weave Code
Jwt Easy Laravel Package
web-token/jwt-easy
Simple JWT helper for PHP apps: quickly encode, decode, and validate JSON Web Tokens with minimal setup. Designed for straightforward auth flows, with easy-to-use APIs for signing, verifying, and reading claims.
Easy toolset to use the JWT Framework.
Frequently asked questions about Jwt Easy
- How do I install jwt-easy in a Laravel project?
- Run `composer require web-token/jwt-easy` in your project directory. The package requires PHP 8.x and depends on `web-token/jwt-framework`, which will be installed automatically. No additional Laravel-specific setup is needed beyond Composer.
- Does jwt-easy support Laravel’s built-in auth system (e.g., Sanctum or Passport)?
- No, jwt-easy is designed for standalone JWT workflows. For hybrid setups (e.g., Sanctum + JWT), you’ll need to manually integrate middleware or guards. It’s best suited for APIs where JWT is the primary auth method.
- What Laravel versions does jwt-easy officially support?
- The package doesn’t enforce Laravel version constraints, but it’s tested against PHP 8.x. For Laravel 9/10 compatibility, ensure your `web-token/jwt-framework` dependency (v2+) aligns with Laravel’s PSR-15/PSR-11 container requirements.
- How do I validate a JWT token in Laravel middleware?
- Extend Laravel’s `Authenticate` middleware or create a custom `JwtMiddleware`. Use `JWT::validate($token)` to check signatures and claims. Example: `if (!$token || !JWT::validate($token)) { abort(401); }` in your route handler.
- Can I use jwt-easy for token revocation? What’s the recommended approach?
- jwt-easy doesn’t include built-in revocation. For production, store tokens in Redis and invalidate them on logout or expiration. Short-lived tokens (e.g., 15-minute TTL) reduce revocation complexity.
- How does jwt-easy compare to lcobucci/jwt or firebase/php-jwt for Laravel?
- jwt-easy prioritizes simplicity with fewer features (e.g., no multi-signature support). `lcobucci/jwt` offers more control and is actively maintained, while `firebase/php-jwt` is heavier. Choose jwt-easy for lightweight APIs; use alternatives for advanced use cases.
- Are there any security risks with jwt-easy I should know about?
- Misconfiguration risks include weak algorithms (e.g., HS256 without a strong key) or missing validation. Always use RS256/ES256 for public-key pairs and validate token claims. Avoid storing sensitive data in JWT payloads.
- How do I add custom claims (e.g., user roles) to a JWT with jwt-easy?
- Use `JWT::setClaim('role', 'admin')` before encoding. Custom claims are merged into the payload. Example: `$token = JWT::encode($payload, $key, 'HS256');` where `$payload` includes your claims array.
- Will jwt-easy break if I upgrade Laravel or PHP?
- Breaking changes are possible due to lack of semantic versioning. Monitor the `web-token/jwt-framework` repo for updates. Test thoroughly after major Laravel/PHP upgrades, especially if using middleware or guards.
- Can I use jwt-easy in a non-Laravel PHP project?
- Yes, jwt-easy is framework-agnostic. It works in any PHP 8.x app. For Laravel, it integrates via middleware/guards, but the core library is standalone. Check the [JWT Framework docs](https://web-token.spomky-labs.com/) for non-Laravel examples.
Weaver
How can I help you explore Laravel packages today?