JWX

A PHP library for JSON web tokens (JWT) with signature (JWS) and encryption (JWE) support.

Also implements unencoded payload option (RFC 7797).

Features

Signing and signature validation (JWS)
- HMAC, RSA and EC
Encryption and decryption with compression and integrity protection (JWE)
- AES
Claims validation
- Configurable with sensible defaults
JSON Web Keys (JWK)
- Convert PEM encoded keys to JWK and vice versa

Supported algorithms

Signature
- HMAC with SHA-256, SHA-384 and SHA-512
- RSASSA-PKCS1-v1_5 with SHA-256, SHA-384 and SHA-512
- ECDSA with P-256, P-384 and P-521 curves
Content encryption
- AES-CBC with 128, 192 and 256-bit key sizes
- AES-GCM with 128, 192 and 256-bit key sizes
Key management
- Shared symmetric key (direct)
- RSAES-PKCS1-v1_5
- RSAES OAEP
- AES Key Wrap with 128, 192 and 256-bit key sizes
- AES-GCM key encryption with 128, 192 and 256-bit key sizes
- Password-based key encryption (PBES2 with AES Key Wrap)
Compression
- DEFLATE

Requirements

Installation

This library is available on Packagist.

composer require sop/jwx

Usage

Claims class holds Claim objects that represent the claims. The claims shall be encoded into a JWT which may further be signed or encrypted, producing a JWS or a JWE respectively.

JWS and JWE may also be used to carry arbitrary payload, not just JSON claims.

Code examples

Simple JWT

Parse JWT from https://jwt.io/ HS512 example.

$jwt = new JWT($token);
// create context for the claims validation
// 'your-512-bit-secret' key is used to verify the signature
$ctx = ValidationContext::fromJWK(
    SymmetricKeyJWK::fromKey('your-512-bit-secret'));
// validate claims
$claims = $jwt->claims($ctx);
// print value of the subject claim
echo $claims->subject()->value();

Additional Validation

Parse the same token as above but additionally validate subject and admin claims.

$jwt = new JWT($token);
// validate that the subject is "1234567890"
// validate that the admin claim is true using explicitly provided validator
$ctx = ValidationContext::fromJWK(
    SymmetricKeyJWK::fromKey('your-512-bit-secret'),
        ['sub' => '1234567890']
    )->withConstraint('admin', true, new EqualsValidator());
// validate and print all claims
$claims = $jwt->claims($ctx);
foreach ($claims as $claim) {
    printf("%s: %s\n", $claim->name(), $claim->value());
}

More Examples

See /examples directory for more examples.

License

This project is licensed under the MIT License.