How to authenticate in PHP API interface using JWT

One of the most common requirements in web development is user authentication. To implement secure authentication, web developers can rely on many different mechanisms. One popular method is JSON Web Tokens (JWT), which provides a token-based authentication method.

In this article, we will introduce the basic concepts of JWT and then demonstrate how to use JWT for authentication in PHP. We'll use a simple example API to illustrate.

1. What is JWT?

JWT is an open standard (RFC 7519), which defines a token protocol based on JSON format for use on the server side Transfer information to and from the client. A JWT consists of three parts: header, payload, and signature.

The header contains metadata about the token, such as token type and signature algorithm. The payload contains the data to be transferred. The transmission of JWT is via Base64 encoding. The signature part is to sign the hash value of the header and payload.

2. How to authenticate using JWT?

In actual applications, we usually generate a JWT after the user successfully logs in, and then send it back to the client. Every time the client accesses a protected API, it needs to send a JWT to the server as authentication information. The server can verify the validity of the JWT and authenticate the user based on it.

Let’s demonstrate how to use JWT for authentication in PHP. In this example, we will create a simple API to validate JWT. The API will accept GET requests and pass JWT as query parameters.

First, we need to install the php-jwt library. We can use Composer to complete the import:

composer require firebase/php-jwt

Then, we need to write a function to convert the payload data to JWT and sign it:

function generateToken($payload) {
    $key = "secret_key";
    $token = array(
        "iss" => "http://example.org",
        "aud" => "http://example.com",
        "iat" => time(),
        "exp" => time() + (60*60),
        "data" => $payload
    );

    return JWT::encode($token, $key);
}

In this function, we set up some basic Metadata such as "iss" (issuer), "aud" (receiver), "iat" (issue time), and "exp" (expiration time). We also add user data to the data section of the JWT. Finally, we sign the JWT using the encode method of the PHP-JWT library, using "secret_key" as the signing key.

Next, we need to write a verification function to check whether the incoming JWT is valid:

function validateToken($jwt) {
    $key = "secret_key";
    try {
        $data = JWT::decode($jwt, $key, array('HS256'));
        return true;
    } catch (Exception $e) {
        return false;
    }
}

In this function, we use the decode method of the PHP-JWT library to decode the JWT and Use the same key for verification. Returns true if the JWT validation passes, false otherwise.

Finally, we need to write an entry script to receive the GET request and verify the JWT:

require_once 'vendor/autoload.php';

use FirebaseJWTJWT;

$jwt = $_GET['jwt'];
if (validateToken($jwt)) {
    $data = JWT::decode($jwt, "secret_key", array('HS256'));
    echo "Welcome " . $data->data->username . "!";
} else {
    echo "Invalid token!";
}

In this script, we first get the JWT from the GET request parameters, and then call the validateToken function to Verify that the JWT is valid. If the JWT is valid, we can decode it, extract our stored user information from it, and welcome the user. Otherwise, we will output "Invalid token!".

The complete code is as follows:

require_once 'vendor/autoload.php';

use FirebaseJWTJWT;

function generateToken($payload) {
    $key = "secret_key";
    $token = array(
        "iss" => "http://example.org",
        "aud" => "http://example.com",
        "iat" => time(),
        "exp" => time() + (60*60),
        "data" => $payload
    );

    return JWT::encode($token, $key);
}

function validateToken($jwt) {
    $key = "secret_key";
    try {
        $data = JWT::decode($jwt, $key, array('HS256'));
        return true;
    } catch (Exception $e) {
        return false;
    }
}

$jwt = $_GET['jwt'];
if (validateToken($jwt)) {
    $data = JWT::decode($jwt, "secret_key", array('HS256'));
    echo "Welcome " . $data->data->username . "!";
} else {
    echo "Invalid token!";
}

3. Summary

This article describes how to use JWT for authentication in PHP. We demonstrated JWT based on a simple API, detailing how to generate and validate a JWT.

The key points of using JWT for authentication are to correctly set the JWT metadata and use the correct signature algorithm. Additionally, JWTs should always be signed using a secure key.

Therefore, when developing applications, you should carefully consider how to use JWT to ensure that your application is secure.

The above is the detailed content of How to authenticate in PHP API interface using JWT. For more information, please follow other related articles on the PHP Chinese website!