基于PHP实现JWT登录鉴权的示例代码

composer require lcobucci/jwt 3.*

<?php
/**
 * Created by PhpStorm
 * @author sxd
 */

namespace App\Utils;


use Lcobucci\JWT\Configuration;
use Lcobucci\JWT\Parser;
use Lcobucci\JWT\Signer\Hmac\Sha256;
use Lcobucci\JWT\Signer\Key\InMemory;
use Lcobucci\JWT\Token\Plain;
use Lcobucci\JWT\Validation\Constraint\IdentifiedBy;
use Lcobucci\JWT\Validation\Constraint\IssuedBy;
use Lcobucci\JWT\Validation\Constraint\PermittedFor;
use Lcobucci\JWT\ValidationData;

class JwtUtil
{
    // jwt github: https://github.com/lcobucci/jwt     https://jwt.io/
    protected $issuer = "http://example.com";
    protected $audience = "http://example.org";
    protected $id = "4f1g23a12aa11";
    // key 是绝对不允许泄露的
    protected static $key = "8swQsm1Xb0TA0Jw5ASPwClKVZPoTyS7GvhtaW0MxzKEihs1BNpcS2q3FYMJ11111";

    /**
     * 签发令牌
     */
    public function getToken()
{
        $time = time();
        $config = self::getConfig();
        assert($config instanceof Configuration);

        // 签发token, 设置签发人、接收人、唯一标识、签发时间、立即生效、过期时间、用户id、用户username、签名
        $token = $config->builder()
            ->issuedBy($this->issuer) // Configures the issuer (iss claim)
            ->permittedFor($this->audience) // Configures the audience (aud claim)
            ->identifiedBy($this->id, true) // Configures the id (jti claim), replicating as a header item
            ->issuedAt($time) // Configures the time that the token was issue (iat claim)
            ->canOnlyBeUsedAfter($time + 1) // Configures the time that the token can be used (nbf claim)  签发x秒钟后生效
            ->expiresAt($time + 3600) // Configures the expiration time of the token (exp claim)
            ->withClaim('uid', 20) // Configures a new claim, called "uid"
            ->withClaim('username', "Make") // Configures a new claim, called "uid"
            ->getToken($config->signer(), $config->signingKey()); // Retrieves the generated token
        return $token->toString();
    }

    /**
     * 验证 jwt token 并返回其中的用户id
     * verify token
     */
    public function verifyToken_bak($token)
{
        try {
            $config = self::getConfig();
            assert($config instanceof Configuration);

            $token = $config->parser()->parse($token);
            assert($token instanceof Plain);

            //Lcobucci\JWT\Validation\Constraint\IdentifiedBy: 验证jwt id是否匹配
            //Lcobucci\JWT\Validation\Constraint\IssuedBy: 验证签发人参数是否匹配
            //Lcobucci\JWT\Validation\Constraint\PermittedFor: 验证受众人参数是否匹配
            //Lcobucci\JWT\Validation\Constraint\RelatedTo: 验证自定义cliam参数是否匹配
            //Lcobucci\JWT\Validation\Constraint\SignedWith: 验证令牌是否已使用预期的签名者和密钥签名
            //Lcobucci\JWT\Validation\Constraint\StrictValidAt: ：：验证存在及其有效性的权利要求中的iat，nbf和exp（支持余地配置
            //Lcobucci\JWT\Validation\Constraint\LooseValidAt: 验证的权利要求iat，nbf和exp，当存在时（支持余地配置）

            //验证jwt id是否匹配
            $validate_jwt_id = new IdentifiedBy($this->id);
            //验证签发人url是否正确
            $validate_issued = new IssuedBy($this->issuer);
            //验证客户端url是否匹配
            $validate_aud = new PermittedFor($this->audience);
            $config->setValidationConstraints($validate_jwt_id, $validate_issued, $validate_aud);

            $constraints = $config->validationConstraints();

            if (!$config->validator()->validate($token, ...$constraints)) {
                die("token invalid!");
            }
        } catch (\Exception $e) {
            die("error:" . $e->getMessage());
        }
        $jwtInfo = $token->claims();  // 这是jwt token中存储的所有信息
        return $jwtInfo->get("uid");  // 获取uid
    }

    /**
     * 加密解密使用的配置
     * @return Configuration
     */
    public static function getConfig()
{
        $configuration = Configuration::forSymmetricSigner(
        // You may use any HMAC variations (256, 384, and 512)
            new Sha256(),
            // replace the value below with a key of your own!
            InMemory::base64Encoded(self::$key)
        // You may also override the JOSE encoder/decoder if needed by providing extra arguments here
        );
        return $configuration;
    }

    /**
     * 另一种验证方法，但是已经弃用
     * verify token
     */
    public function verifyToken($token)
{
        $token = (new Parser())->parse((string)$token);
        //验证token
        $data = new ValidationData();
        $data->setIssuer($this->issuer);//验证的签发人
        $data->setAudience($this->audience);//验证的接收人
        $data->setId($this->id);//验证token标识

        if (!$token->validate($data)) {
            //token验证失败
            die("token invalid!");
        }
        $jwtInfo = $token->claims();  // 这是jwt token中存储的所有信息
        return $jwtInfo->get("uid");  // 获取uid
    }

}