A simple JSON web token library written in PHP.
SimpleJWT is a simple JSON web token library written in PHP.
gmp
extensionhash
extensionopenssl
extensionsodium
extension for EdDSA and X25519 supportYou can install via Composer.
composer require kelvinmo/simplejwt
Keys used to sign or verify a JWT must firstly be added to a KeySet. You can add keys in the following ways:
$set = new SimpleJWT\Keys\KeySet();
$set->load(file_get_contents('private.json'));
$set = new SimpleJWT\Keys\KeySet();
// JWK format
$key = new SimpleJWT\Keys\RSAKey(file_get_contents('jwk.json'), 'json');
// PEM format - note raw key only, no X.509 certificates
$key = new SimpleJWT\Keys\RSAKey(file_get_contents('rsa.pem'), 'pem');
$set->add($key);
$set = SimpleJWT\Keys\KeySet::createFromSecret('secret123');
// The above is a shortcut for the following:
$set = new SimpleJWT\Keys\KeySet();
$key = new SimpleJWT\Keys\SymmetricKey('secret123', 'bin');
$set->add($key);
To create a JWT, set up the desired headers and claims as separate arrays, then
create a JWT
object:
// Note $headers['alg'] is required
$headers = ['alg' => 'HS256', 'typ' => 'JWT'];
$claims = ['iss' => 'me', 'exp' => 1234567];
$jwt = new SimpleJWT\JWT($headers, $claims);
The JWT can then be signed and encoded:
try {
print $jwt->encode($set);
} catch (\RuntimeException $e) {
}
By default, SimpleJWT will automatically include a kid
(Key ID) header and
a iat
(Issued At) claim in all JWTs. If the key used to sign the JWT does
not have a kid
assigned (e.g. if it is imported from a PEM file), a kid
is generated. You can disable this behaviour by specifying $auto_complete
to false when calling SimpleJWT\JWT::encode()
.
To consume and verify a JWT, use the decode function. Note that you will need
to supply the expected alg
parameter that has been previously agreed out-of-band.
try {
$jwt = SimpleJWT\JWT::decode('abc.def.ghigjghr', $set, 'HS256');
} catch (SimpleJWT\InvalidTokenException $e) {
}
print $jwt->getHeader('alg');
print $jwt->getClaim('sub');
You can also deserialise a JWT without verifying it using the deserialise function. Note that you should not trust the contents of the data contained in a JWT without verifying them.
try {
$result = SimpleJWT\JWT::deserialise('abc.def.ghigjghr');
} catch (SimpleJWT\InvalidTokenException $e) {
}
print $result['claims']['sub'];
print $result['signatures'][0]['headers']['alg'];
print $result['signatures'][0]['signing_input']; // abc.def
print $result['signatures'][0]['signature']; // ghigjghr
// Additional indices under $result['signatures'] if the JWT has more than
// one signature
To create a JWE, set up the desired header array and plaintext, then
create a JWE
object:
// Note $headers['alg'] and $headers['enc'] are required
$headers = ['alg' => 'PBES2-HS256+A128KW', 'enc' => 'A128CBC-HS256'];
$plaintext = 'This is the plaintext I want to encrypt.';
$jwt = new SimpleJWT\JWE($headers, $plaintext);
The JWE can then be encrypted:
try {
print $jwt->encrypt($set);
} catch (\RuntimeException $e) {
}
To decrypt a JWE, use the decrypt function:
try {
$jwt = SimpleJWT\JWE::decrypt('abc.def.ghi.klm.nop', $set, 'PBES2-HS256+A128KW');
} catch (SimpleJWT\InvalidTokenException $e) {
}
print $jwt->getHeader('alg');
print $jwt->getPlaintext();
BSD 3 clause