Repository files navigation

This package provides out-of-the-box API authentication using JWT for Laravel.

You can install this package by running:

composer require codecasts/laravel-jwt

In order to setup this package into your application, minimal configurationis actually needed.

Register this package's Service Provider by adding it to theproviderssection of yourconfig/app.php file:

You may skip this step on Laravel 5.5 due to theauto-discovery package feature.

'providers' => [// ... other providers omittedCodecasts\Auth\JWT\ServiceProvider::class,   ],

Publish the configuration file (config/jwt.php) by running thefollowing command after registering the Service Provider.

php artisan vendor:publish --provider="Codecasts\Auth\JWT\ServiceProvider"

In order for this package to works, you will need a separate secret(do not use the application key).

This package provides a command that can be used for generating a strong key.

Get a new key by running:

php artisan jwt:generate

Then, copy the generated key contents into your.env file.

NOTICE: The key generation process will not automaticallyset it inside your.env file, do it manually.

In order to automatically authenticate your routes usingJWT tokens,you need to change the guard driver tojwt

Insideconfig/auth.php set the corresponding guard group you want to protect:

If you have the default guard group namedapi, yourauth.phpshould be like this:

'guards' => [// ... other guards omitted.'api' => ['driver'   =>'jwt',// this is the line you need to change.'provider' =>'users',        ],    ],

That's it, we are all ready to use it.

This package aims to be dead simple to use.

The following templates can be used to setup your existingauthentication controllers and resources.

NOTICE: Full working examples of use for this packagewill be added on this package when it reaches it's 1.0 version.

This package is fully integrated with Laravel Authentication.

The default configuration (config/jwt.php) brings a sensitive value thatis very useful when your application is not completely an API:middleware_match

By not completely an API, I mean, the JWT guard is not the default one.

In those cases, in order to use theauth middleware, the config keymiddleware_matchMUST be set to true.

This configuration key allows non protected routes to work properly.

Notice that this option will match middleware group names with guard names.

In this case, the 'api' middleware group will always use theapi guard.

Also, the 'web' middleware group will always use theweb guard

If you do not use this value, you will need to use suffixes when referencing theauth middleware, likeauth:api.

For issuing tokens, no special class is actually needed,you can just expect create a Guard current implementation from the IoC and work from there.

Check out the examples.

On the following examples, all Guard instances are injected fromIlluminate\Contracts\Auth\Guard

On the following examples, all Request instances are injected fromIlluminate\Http\Request

This method should be used when you just registered a user and any otherspecial cases.

publicfunctiontokenFromUser(Guard$auth){// generating a token from a given user.$user = SomeUserModel::find(12);// logs in the user$auth->login($user);// get and return a new token$token =$auth->issue();return$token;}

This method should be used when you just registered a user and any otherspecial cases.

publicfunctiontokenFromCredentials(Guard$auth,Request$request){// get some credentials$credentials =$request->only(['email','password']);if ($auth->attempt($credentials)) {return$token =$auth->issue();    }return ['Invalid Credentials'];}

Tokens can be refreshed in 2 different ways: Auto detect or manual.

If you do not pass any argument into the refresh method, the Guard willlook for either aAuthorization header or atoken field on therequest's body.

publicfunctionrefreshToken(Guard$auth){// auto detecting token from request.$token =$auth->refresh();// manually passing the token to be refreshed.$token =$auth->refresh($oldToken);return$token;}

Of course, there are support for custom claims.

You can set them in two ways.

$customClaims = ['custom1' =>'value1','custom2' =>'value2',];// when issuing$auth->issue($customClaims);// when refreshing// custom claims are the second parameter as the first one is the// old token$auth->refresh(null,$customClaims);

If all your users will have the same custom claims, you can setup a defaultcustom claims method on your User's model (or any other Authenticatable you're using):

If the methodcustomJWTClaims() is present on the model being issue the token against,this claims will be automatically included.

class Userextends Modelimplements Authenticatable{publicfunctioncustomJWTClaims()    {return ['email' =>$this->email,'name'  =>$this->name,        ];    }}

Please seeCONTRIBUTING for details.