GitHub - firebase/php-jwt: PEAR package for JWT
PHP-JWT
A simple library to encode and decode JSON Web Tokens (JWT) in PHP, conforming to RFC 7519.
Installation
Use composer to manage your dependencies and download PHP-JWT:
composer require firebase/php-jwt
Example
<?php use \Firebase\JWT\JWT; $key = "example_key"; $token = array( "iss" => "http://example.org", "aud" => "http://example.com", "iat" => 1356999524, "nbf" => 1357000000 ); /** * IMPORTANT: * You must specify supported algorithms for your application. See * https://tools.ietf.org/html/draft-ietf-jose-json-web-algorithms-40 * for a list of spec-compliant algorithms. */ $jwt = JWT::encode($token, $key); $decoded = JWT::decode($jwt, $key, array('HS256')); print_r($decoded); /* NOTE: This will now be an object instead of an associative array. To get an associative array, you will need to cast it as such: */ $decoded_array = (array) $decoded; /** * You can add a leeway to account for when there is a clock skew times between * the signing and verifying servers. It is recommended that this leeway should * not be bigger than a few minutes. * * Source: http://self-issued.info/docs/draft-ietf-oauth-json-web-token.html#nbfDef */ JWT::$leeway = 60; // $leeway in seconds $decoded = JWT::decode($jwt, $key, array('HS256')); ?>
Example with RS256 (openssl)
<?php use \Firebase\JWT\JWT; $privateKey = <<<EOD -----BEGIN RSA PRIVATE KEY----- MIICXAIBAAKBgQC8kGa1pSjbSYZVebtTRBLxBz5H4i2p/llLCrEeQhta5kaQu/Rn vuER4W8oDH3+3iuIYW4VQAzyqFpwuzjkDI+17t5t0tyazyZ8JXw+KgXTxldMPEL9 5+qVhgXvwtihXC1c5oGbRlEDvDF6Sa53rcFVsYJ4ehde/zUxo6UvS7UrBQIDAQAB AoGAb/MXV46XxCFRxNuB8LyAtmLDgi/xRnTAlMHjSACddwkyKem8//8eZtw9fzxz bWZ/1/doQOuHBGYZU8aDzzj59FZ78dyzNFoF91hbvZKkg+6wGyd/LrGVEB+Xre0J Nil0GReM2AHDNZUYRv+HYJPIOrB0CRczLQsgFJ8K6aAD6F0CQQDzbpjYdx10qgK1 cP59UHiHjPZYC0loEsk7s+hUmT3QHerAQJMZWC11Qrn2N+ybwwNblDKv+s5qgMQ5 5tNoQ9IfAkEAxkyffU6ythpg/H0Ixe1I2rd0GbF05biIzO/i77Det3n4YsJVlDck ZkcvY3SK2iRIL4c9yY6hlIhs+K9wXTtGWwJBAO9Dskl48mO7woPR9uD22jDpNSwe k90OMepTjzSvlhjbfuPN1IdhqvSJTDychRwn1kIJ7LQZgQ8fVz9OCFZ/6qMCQGOb qaGwHmUK6xzpUbbacnYrIM6nLSkXgOAwv7XXCojvY614ILTK3iXiLBOxPu5Eu13k eUz9sHyD6vkgZzjtxXECQAkp4Xerf5TGfQXGXhxIX52yH+N2LtujCdkQZjXAsGdm B2zNzvrlgRmgBrklMTrMYgm1NPcW+bRLGcwgW2PTvNM= -----END RSA PRIVATE KEY----- EOD; $publicKey = <<<EOD -----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC8kGa1pSjbSYZVebtTRBLxBz5H 4i2p/llLCrEeQhta5kaQu/RnvuER4W8oDH3+3iuIYW4VQAzyqFpwuzjkDI+17t5t 0tyazyZ8JXw+KgXTxldMPEL95+qVhgXvwtihXC1c5oGbRlEDvDF6Sa53rcFVsYJ4 ehde/zUxo6UvS7UrBQIDAQAB -----END PUBLIC KEY----- EOD; $token = array( "iss" => "example.org", "aud" => "example.com", "iat" => 1356999524, "nbf" => 1357000000 ); $jwt = JWT::encode($token, $privateKey, 'RS256'); echo "Encode:\n" . print_r($jwt, true) . "\n"; $decoded = JWT::decode($jwt, $publicKey, array('RS256')); /* NOTE: This will now be an object instead of an associative array. To get an associative array, you will need to cast it as such: */ $decoded_array = (array) $decoded; echo "Decode:\n" . print_r($decoded_array, true) . "\n"; ?>
Changelog
5.0.0 / 2017-06-26
- Support RS384 and RS512. See #117. Thanks @joostfaassen!
- Add an example for RS256 openssl. See #125. Thanks @akeeman!
- Detect invalid Base64 encoding in signature. See #162. Thanks @psignoret!
- Update
JWT::verify
to handle OpenSSL errors. See #159. Thanks @bshaffer! - Add
array
type hinting todecode
method See #101. Thanks @hywak! - Add all JSON error types. See #110. Thanks @gbalduzzi!
- Bugfix 'kid' not in given key list. See #129. Thanks @stampycode!
- Miscellaneous cleanup, documentation and test fixes. See #107, #115, #160, #161, and #165. Thanks @akeeman,@chinedufn, and @bshaffer!
4.0.0 / 2016-07-17
- Add support for late static binding. See #88 for details. Thanks to @chappy84!
- Use static
$timestamp
instead oftime()
to improve unit testing. See #93 for details. Thanks to @josephmcdermott! - Fixes to exceptions classes. See #81 for details. Thanks to @Maks3w!
- Fixes to PHPDoc. See #76 for details. Thanks to @akeeman!
3.0.0 / 2015-07-22
- Minimum PHP version updated from
5.2.0
to5.3.0
. - Add
\Firebase\JWT
namespace. See #59 for details. Thanks to @Dashron! - Require a non-empty key to decode and verify a JWT. See #60 for details. Thanks to @sjones608!
- Cleaner documentation blocks in the code. See #62 for details. Thanks to @johanderuijter!
2.2.0 / 2015-06-22
- Add support for adding custom, optional JWT headers to
JWT::encode()
. See #53 for details. Thanks to @mcocaro!
2.1.0 / 2015-05-20
- Add support for adding a leeway to
JWT:decode()
that accounts for clock skew between signing and verifying entities. Thanks to @lcabral! - Add support for passing an object implementing the
ArrayAccess
interface for$keys
argument inJWT::decode()
. Thanks to @aztech-dev!
2.0.0 / 2015-04-01
- Note: It is strongly recommended that you update to > v2.0.0 to address known security vulnerabilities in prior versions when both symmetric and asymmetric keys are used together.
- Update signature for
JWT::decode(...)
to require an array of supported algorithms to use when verifying token signatures.
Tests
Run the tests using phpunit:
$ pear install PHPUnit $ phpunit --configuration phpunit.xml.dist PHPUnit 3.7.10 by Sebastian Bergmann. ..... Time: 0 seconds, Memory: 2.50Mb OK (5 tests, 5 assertions)
New Lines in private keys
If your private key contains \n
characters, be sure to wrap it in double quotes ""
and not single quotes ''
in order to properly interpret the escaped characters.
【推荐】编程新体验,更懂你的AI,立即体验豆包MarsCode编程助手
【推荐】凌霞软件回馈社区,博客园 & 1Panel & Halo 联合会员上线
【推荐】抖音旗下AI助手豆包,你的智能百科全书,全免费不限次数
【推荐】轻量又高性能的 SSH 工具 IShell:AI 加持,快人一步
· 深入理解 Mybatis 分库分表执行原理
· 如何打造一个高并发系统?
· .NET Core GC压缩(compact_phase)底层原理浅谈
· 现代计算机视觉入门之:什么是图片特征编码
· .NET 9 new features-C#13新的锁类型和语义
· 《HelloGitHub》第 106 期
· Spring AI + Ollama 实现 deepseek-r1 的API服务和调用
· 数据库服务器 SQL Server 版本升级公告
· 深入理解Mybatis分库分表执行原理
· 使用 Dify + LLM 构建精确任务处理应用