php 公钥 签名,使用PHP中的RSA公钥验证JWT签名

// File test.php

require_once __DIR__.'/vendor/autoload.php';

use Jose\Checker\ExpirationChecker;

use Jose\Checker\IssuedAtChecker;

use Jose\Checker\NotBeforeChecker;

use Jose\Factory\KeyFactory;

use Jose\Factory\LoaderFactory;

use Jose\Factory\VerifierFactory;

use Jose\Object\JWKSet;

use Jose\Object\JWSInterface;

// We create a JWT loader.

$loader = LoaderFactory::createLoader();

// We load the input

$jwt = $loader->load($input);

if (!$jws instanceof JWSInterface) {

die('Not a JWS');

}

// Please note that at this moment the signature and the claims are not verified

// To verify a JWS, we need a JWKSet that contains public keys (from RSA key in your case).

// We create our key object (JWK) using a RSA public key

$jwk = KeyFactory::createFromPEM('-----BEGIN RSA PUBLIC KEY-----...');

// Then we set this key in a keyset (JWKSet object)

// Be careful, the JWKSet object is immutable. When you add a key, you get a new JWKSet object.

$jwkset = new JWKSet();

$jwkset = $jwkset->addKey($jwk);

// We create our verifier object with a list of authorized signature algorithms (only 'RS512' in this example)

// We add some checkers. These checkers will verify claims or headers.

$verifier = VerifierFactory::createVerifier(

['RS512'],

[

new IssuedAtChecker(),

new NotBeforeChecker(),

new ExpirationChecker(),

]

);

$is_valid = $verifier->verify($jws, $jwkset);

// The variable $is_valid contains a boolean that indicates the signature is valid or not.

// If a claim is not verified (e.g. the JWT expired), an exception is thrown.

//Now you can use the $jws object to retreive all claims or header key/value pairs