Weave Code
Jwt Framework Laravel Package
web-token/jwt-framework
A comprehensive PHP library for JSON Web Tokens, implementing JWS, JWE, JWK, JWT, and related RFCs. It offers signing, encryption, key management, and token validation with a clean, standards-compliant API suitable for any PHP project.
JSON Web Tokens: JWS, JWE and JWK.
Frequently asked questions about Jwt Framework
- Is web-token/jwt-framework suitable for Laravel applications?
- It is suitable when you need JOSE capabilities beyond basic API tokens, such as JWKS verification of tokens issued elsewhere, encrypted JWE claims, EdDSA, or strict algorithm negotiation. For simple first-party API tokens, Laravel Sanctum or Passport is usually cheaper. The package is framework-agnostic, so Laravel integration requires thin glue rather than a drop-in provider.
- Should I use web-token/jwt-framework or web-token/jwt-library in Laravel?
- For Laravel, prefer web-token/jwt-library rather than the jwt-framework aggregate. jwt-framework pulls in the Symfony bundle and console tooling, which duplicates container, config and console concerns in a Laravel app. jwt-library gives the core JOSE primitives with fewer framework dependencies.
- How do I install web-token/jwt-framework in Laravel?
- Install with Composer, but choose the artifact deliberately: composer require web-token/jwt-library for Laravel, or web-token/jwt-framework only if you explicitly need the aggregate. There is no package auto-discovery, so you must register any wrapper service provider and create or publish your own config for keys and algorithm allowlists.
- Does web-token/jwt-framework support Laravel 10 and 11?
- The project is framework-agnostic and has no first-party Laravel version constraint; compatibility depends on the PHP version and PSR or Symfony dependency constraints in your app. It can be used with modern Laravel releases when those constraints match, but you should verify Composer requirements rather than assuming a Laravel 10 or 11 support matrix. Using jwt-library reduces the dependency surface.
- Does web-token/jwt-framework have a Laravel service provider or config file?
- No, there is no first-party Laravel service provider or config file. You own the glue: typically one service provider, one config file for key material and allowed algorithms, and a small wrapper exposing sign, verify and decrypt. This keeps the integration explicit but means you also own its upgrade surface.
- How do I verify third-party JWTs with JWKS in Laravel using this package?
- Use the library's JWK set and JWS verification components, point the remote key-set factory at the identity provider's JWKS URL, and cache fetched keys through Laravel's cache repository. Enforce kid lookup, issuer, audience and expiry checks, and set bounded cache staleness so revoked or rotated keys are picked up. Do not silently fall back to the first key in a set.
- Can web-token/jwt-framework sign and encrypt JWE tokens in Laravel?
- Yes, the JOSE stack includes JWS signing and JWE encryption, with key wrapping options such as RSA-OAEP, AES-GCM, ECDH-ES and PBES2 across the supported algorithm matrix. In Laravel you would expose sign, verify and decrypt through a thin wrapper and configure allowed algorithms explicitly. Start with the algorithms your business requires, such as RS256 or ES256 verification, and defer JWE if it is not needed.
- What security pitfalls should I avoid when using web-token/jwt-framework in Laravel?
- The main risk is configuration rather than the primitives: avoid accepting alg none, prevent HMAC and RSA algorithm confusion, enforce strict kid matching, bound JWKS cache staleness, and handle clock skew deliberately. Pin versions carefully because multiple branches receive patches and minor releases have introduced deprecations and constructor changes. Treat algorithm allowlists and key material as security-critical config.
- How do I test JWT signing and verification in a Laravel app?
- Test with known-good and known-bad token fixtures, including expired tokens, wrong issuer or audience, unknown kid, tampered signatures and disallowed algorithms. Use fixed clocks or injectable clock behavior where possible so expiry and skew tests are deterministic. Also test your wrapper's failure modes, not just the library's happy path.
- Is web-token/jwt-framework maintained and what alternatives should Laravel teams consider?
- It is actively maintained with good test coverage and an MIT licence, but it has a single primary maintainer, which is a real bus factor for a cryptographic dependency. For Laravel alternatives, consider Sanctum or Passport for first-party auth, lcobucci/jwt for simpler signed-token needs, and firebase/php-jwt for basic verification. Choose web-token when you need the broader JOSE stack such as JWE, JWKS or EdDSA.
Weaver
How can I help you explore Laravel packages today?