基於PHP實現JWT登入鑑權的範例程式碼

composer require lcobucci/jwt 3.*

<?php
/**
 * Created by PhpStorm
 * @author sxd
 */

namespace AppUtils;


use LcobucciJWTConfiguration;
use LcobucciJWTParser;
use LcobucciJWTSignerHmacSha256;
use LcobucciJWTSignerKeyInMemory;
use LcobucciJWTTokenPlain;
use LcobucciJWTValidationConstraintIdentifiedBy;
use LcobucciJWTValidationConstraintIssuedBy;
use LcobucciJWTValidationConstraintPermittedFor;
use LcobucciJWTValidationData;

class JwtUtil
{
    // jwt github: https://github.com/lcobucci/jwt     https://jwt.io/
    protected $issuer = "http://example.com";
    protected $audience = "http://example.org";
    protected $id = "4f1g23a12aa11";
    // key 是絕對不允許洩露的
    protected static $key = "8swQsm1Xb0TA0Jw5ASPwClKVZPoTyS7GvhtaW0MxzKEihs1BNpcS2q3FYMJ11111";

    /**
     * 簽發令牌
     */
    public function getToken()
{
        $time = time();
        $config = self::getConfig();
        assert($config instanceof Configuration);

        // 簽發token, 設定簽發人、接收人、唯一標識、簽發時間、立即生效、過期時間、使用者id、使用者username、簽名
        $token = $config->builder()
            ->issuedBy($this->issuer) // Configures the issuer (iss claim)
            ->permittedFor($this->audience) // Configures the audience (aud claim)
            ->identifiedBy($this->id, true) // Configures the id (jti claim), replicating as a header item
            ->issuedAt($time) // Configures the time that the token was issue (iat claim)
            ->canOnlyBeUsedAfter($time + 1) // Configures the time that the token can be used (nbf claim)  簽發x秒鐘後生效
            ->expiresAt($time + 3600) // Configures the expiration time of the token (exp claim)
            ->withClaim('uid', 20) // Configures a new claim, called "uid"
            ->withClaim('username', "Make") // Configures a new claim, called "uid"
            ->getToken($config->signer(), $config->signingKey()); // Retrieves the generated token
        return $token->toString();
    }

    /**
     * 驗證 jwt token 並返回其中的使用者id
     * verify token
     */
    public function verifyToken_bak($token)
{
        try {
            $config = self::getConfig();
            assert($config instanceof Configuration);

            $token = $config->parser()->parse($token);
            assert($token instanceof Plain);

            //LcobucciJWTValidationConstraintIdentifiedBy: 驗證jwt id是否匹配
            //LcobucciJWTValidationConstraintIssuedBy: 驗證簽發人引數是否匹配
            //LcobucciJWTValidationConstraintPermittedFor: 驗證受眾人引數是否匹配
            //LcobucciJWTValidationConstraintRelatedTo: 驗證自定義cliam引數是否匹配
            //LcobucciJWTValidationConstraintSignedWith: 驗證令牌是否已使用預期的簽名者和金鑰簽名
            //LcobucciJWTValidationConstraintStrictValidAt: ：：驗證存在及其有效性的權利要求中的iat，nbf和exp（支援餘地設定
            //LcobucciJWTValidationConstraintLooseValidAt: 驗證的權利要求iat，nbf和exp，當存在時（支援餘地設定）

            //驗證jwt id是否匹配
            $validate_jwt_id = new IdentifiedBy($this->id);
            //驗證簽發人url是否正確
            $validate_issued = new IssuedBy($this->issuer);
            //驗證使用者端url是否匹配
            $validate_aud = new PermittedFor($this->audience);
            $config->setValidationConstraints($validate_jwt_id, $validate_issued, $validate_aud);

            $constraints = $config->validationConstraints();

            if (!$config->validator()->validate($token, ...$constraints)) {
                die("token invalid!");
            }
        } catch (Exception $e) {
            die("error:" . $e->getMessage());
        }
        $jwtInfo = $token->claims();  // 這是jwt token中儲存的所有資訊
        return $jwtInfo->get("uid");  // 獲取uid
    }

    /**
     * 加密解密使用的設定
     * @return Configuration
     */
    public static function getConfig()
{
        $configuration = Configuration::forSymmetricSigner(
        // You may use any HMAC variations (256, 384, and 512)
            new Sha256(),
            // replace the value below with a key of your own!
            InMemory::base64Encoded(self::$key)
        // You may also override the JOSE encoder/decoder if needed by providing extra arguments here
        );
        return $configuration;
    }

    /**
     * 另一種驗證方法，但是已經棄用
     * verify token
     */
    public function verifyToken($token)
{
        $token = (new Parser())->parse((string)$token);
        //驗證token
        $data = new ValidationData();
        $data->setIssuer($this->issuer);//驗證的簽發人
        $data->setAudience($this->audience);//驗證的接收人
        $data->setId($this->id);//驗證token標識

        if (!$token->validate($data)) {
            //token驗證失敗
            die("token invalid!");
        }
        $jwtInfo = $token->claims();  // 這是jwt token中儲存的所有資訊
        return $jwtInfo->get("uid");  // 獲取uid
    }

}