JSON Web Token (JWT) Authentication with PHP

A guide on using JSON Web Token (JWT) for authentication in PHP. Using JWT ensures secure transmission of information between client and server and is easy to implement in web applications.

In this article, we will explore how to use JWT for user authentication in PHP applications. JWT is an open standard that allows secure data transmission between client and server through encrypted tokens, making it easy to verify user authenticity.

PHP Code

<?php
// Required JWT library, can be installed via Composer
require 'vendor/autoload.php';
use \Firebase\JWT\JWT;

// Secret key for encoding JWT
$secretKey = 'your-secret-key';

// User data to be encoded into the token
$data = [
    'id' => 123,
    'email' => '[email protected]',
    'exp' => time() + 3600 // Expires after 1 hour
];

// Encode the token
$jwt = JWT::encode($data, $secretKey);

// Output the token
echo "JWT Token: " . $jwt . "\n";

// Decode the token
try {
    $decoded = JWT::decode($jwt, $secretKey, ['HS256']);
    echo "Decoded Data:\n";
    print_r($decoded);
} catch (Exception $e) {
    echo "Invalid token: " . $e->getMessage();
}
?>

Detailed explanation:

1. require 'vendor/autoload.php';: Loads the required libraries from Composer, including the Firebase JWT library.
2. use \Firebase\JWT\JWT;: Uses the JWT class for encoding and decoding tokens.
3. $secretKey: This is the secret key used for encoding and decoding the JWT. It must be kept secure.
4. $data: The user data to be encoded into the JWT. Here, it includes id, email, and exp (expiration time).
5. JWT::encode($data, $secretKey): Encodes the data array into a JWT token using the secret key.
6. JWT::decode($jwt, $secretKey, ['HS256']): Decodes the JWT using the secret key and checks if the token is valid.
7. catch (Exception $e): Catches any errors if the token is invalid or cannot be decoded.

System requirements:

• PHP >= 7.2
• Composer
• Firebase JWT library (firebase/php-jwt)

How to install the libraries needed to run the PHP code above:

• Install Composer: https://getcomposer.org/download/
• Run the following command to install the JWT library:

  composer require firebase/php-jwt
  

Tips:

• Avoid storing the secret key within the same system as the source code to improve security.
• Configure JWT expiration times appropriately to avoid potential security issues.

---