How to implement JWT authentication in PHP with firebase package

Details



Implementing JWT (JSON Web Token) authentication in PHP involves several steps. Here's a detailed explanation of how you can achieve it using the firebase/php-jwt package.

 

Step 1:

Install Dependencies To start, you need to install the required dependencies using Composer, which is a package manager for PHP. Open your terminal and navigate to your project directory, then run the following command to create a composer.json file:

composer init

Follow the prompts to set up your composer.json file, and once it's created, run the following command to install the required dependencies:

composer require firebase/php-jwt

This will install the firebase/php-jwt package, which provides JWT functionality in PHP.

Step 2:

Generate JWT on Login When a user successfully logs in, you need to generate a JWT and send it back to the client. Here's an example of how you can generate a JWT using the firebase/php-jwt package:

<?php
require_once 'vendor/autoload.php';

use \Firebase\JWT\JWT;

// Set your secret key
$secretKey = 'your_secret_key';

// Set your payload (user data)
$payload = array(
    'user_id' => 123,
    'username' => 'john.doe'
);

// Generate JWT
$jwt = JWT::encode($payload, $secretKey, 'HS256');

// Return the JWT to the client
echo $jwt;
?>

In this example, replace 'your_secret_key' with a secure secret key of your choice, and customize the $payload array with the relevant user data.

 

Step 3:

Verify JWT on Protected Routes For routes that require authentication, you need to verify the JWT sent by the client. Here's an example of how you can verify a JWT using the firebase/php-jwt package:

<?php
require_once 'vendor/autoload.php';

use \Firebase\JWT\JWT;

// Set your secret key
$secretKey = 'your_secret_key';

// Get the JWT from the request header or other means
$jwt = $_SERVER['HTTP_AUTHORIZATION'];

// Remove the "Bearer " prefix from the JWT
$jwt = str_replace('Bearer ', '', $jwt);

try {
    // Verify the JWT
    $decoded = JWT::decode($jwt, $secretKey, array('HS256'));
    
    // Access the user data from the decoded JWT
    $userId = $decoded->user_id;
    $username = $decoded->username;

    // Proceed with the protected route logic
    // ...
    
    // Return a response to the client
    echo 'Authenticated user: ' . $username;
} catch (Exception $e) {
    // Handle JWT verification error
    http_response_code(401);
    echo 'Invalid token';
}
?>

In this example, replace 'your_secret_key' with the same secret key used during JWT generation.

 

Step 4:

Protect Routes with JWT Authentication To protect your routes with JWT authentication, you need to include the JWT verification code from the previous step in the relevant PHP files. For example, if you have a file named protected_route.php, you can add the JWT verification code at the beginning of the file.

<?php
require_once 'vendor/autoload.php';

use \Firebase\JWT\JWT;

// Set your secret key
$secretKey = 'your_secret_key';

// Get the JWT from the request header or other means
$jwt = $_SERVER['HTTP_AUTHORIZATION'];

// Remove the "Bearer " prefix from the JWT
$jwt = str_replace('Bearer ', '', $jwt);

try {
    // Verify the JWT
    $decoded = JWT::decode($jwt, $secretKey, array('HS256'));
    
    // Access the user data from the decoded JWT
    $userId = $decoded->user_id;
    $username = $decoded->username;

    // Proceed with the protected route logic
    // ...
    
    // Return a response to the client
    echo 'Authenticated user: ' . $username;
} catch (Exception $e) {
    // Handle JWT verification error
    http_response_code(401);
    echo 'Invalid token';
}
?>

This code snippet will protect the protected_route.php file, ensuring that only authenticated requests with valid JWTs can access it.

That's it! You've implemented JWT authentication in PHP using the firebase/php-jwt package. Remember to keep your secret key secure and follow best practices for handling JWTs, such as setting appropriate expiration times and refreshing tokens when necessary.

More Articles on this Topic: