环境
Laravel框架版本:7.30.6
php版本:7.4.3
安装 Laravel 框架
composer create-project --prefer-dist laravel/laravel blog "7.*"
安装 JWT
$ composer require tymon/jwt-auth 1.0.2
发布 JWT 配置
php artisan vendor:publish --provider="Tymon\JWTAuth\Providers\LaravelServiceProvider"
此命令会在 config
目录下生成一个 jwt.php
配置文件
<?php
/*
* This file is part of jwt-auth.
*
* (c) Sean Tymon <tymon148@gmail.com>
*
* For the full copyright and license information, please view the LICENSE
* file that was distributed with this source code.
*/
return [
/*
|--------------------------------------------------------------------------
| JWT Authentication Secret
|--------------------------------------------------------------------------
|
| Don't forget to set this in your .env file, as it will be used to sign
| your tokens. A helper command is provided for this:
| `php artisan jwt:secret`
|
| Note: This will be used for Symmetric algorithms only (HMAC),
| since RSA and ECDSA use a private/public key combo (See below).
|
| 加密生成 token 的 secret
*/
'secret' => env('JWT_SECRET'),
/*
|--------------------------------------------------------------------------
| JWT Authentication Keys
|--------------------------------------------------------------------------
|
| The algorithm you are using, will determine whether your tokens are
| signed with a random string (defined in `JWT_SECRET`) or using the
| following public & private keys.
|
| Symmetric Algorithms:
| HS256, HS384 & HS512 will use `JWT_SECRET`.
|
| Asymmetric Algorithms:
| RS256, RS384 & RS512 / ES256, ES384 & ES512 will use the keys below.
|
| 如果你在 .env 文件中定义了 JWT_SECRET 的随机字符串
| 那么 jwt 将会使用 对称算法 来生成 token
| 如果你没有定有,那么jwt 将会使用如下配置的公钥和私钥来生成 token
*/
'keys' => [
/*
|--------------------------------------------------------------------------
| Public Key
|--------------------------------------------------------------------------
|
| A path or resource to your public key.
|
| E.g. 'file://path/to/public/key'
|
*/
'public' => env('JWT_PUBLIC_KEY'),
/*
|--------------------------------------------------------------------------
| Private Key
|--------------------------------------------------------------------------
|
| A path or resource to your private key.
|
| E.g. 'file://path/to/private/key'
|
*/
'private' => env('JWT_PRIVATE_KEY'),
/*
|--------------------------------------------------------------------------
| Passphrase
|--------------------------------------------------------------------------
|
| The passphrase for your private key. Can be null if none set.
|
*/
'passphrase' => env('JWT_PASSPHRASE'),
],
/*
|--------------------------------------------------------------------------
| JWT time to live
|--------------------------------------------------------------------------
|
| Specify the length of time (in minutes) that the token will be valid for.
| Defaults to 1 hour.
|
| You can also set this to null, to yield a never expiring token.
| Some people may want this behaviour for e.g. a mobile app.
| This is not particularly recommended, so make sure you have appropriate
| systems in place to revoke the token if necessary.
| Notice: If you set this to null you should remove 'exp' element from 'required_claims' list.
| 指定 access_token 有效的时间长度(以分钟为单位),默认为1小时,您也可以将其设置为空,以产生永不过期的标记
*/
'ttl' => env('JWT_TTL', 60),
/*
|--------------------------------------------------------------------------
| Refresh time to live
|--------------------------------------------------------------------------
|
| Specify the length of time (in minutes) that the token can be refreshed
| within. I.E. The user can refresh their token within a 2 week window of
| the original token being created until they must re-authenticate.
| Defaults to 2 weeks.
|
| You can also set this to null, to yield an infinite refresh time.
| Some may want this instead of never expiring tokens for e.g. a mobile app.
| This is not particularly recommended, so make sure you have appropriate
| systems in place to revoke the token if necessary.
|
| access_token 可刷新的时间长度(以分钟为单位)。默认的时间为 2 周。
| 用法:如果用户有一个 access_token,那么他可以带着他的 access_token
| 过来领取新的 access_token,直到 2 周的时间后,他便无法继续刷新了,需要重新登录。
*/
'refresh_ttl' => env('JWT_REFRESH_TTL', 20160),
/*
|--------------------------------------------------------------------------
| JWT hashing algorithm
|--------------------------------------------------------------------------
|
| Specify the hashing algorithm that will be used to sign the token.
|
| See here: https://github.com/namshi/jose/tree/master/src/Namshi/JOSE/Signer/OpenSSL
| for possible values.
| 指定将用于对令牌进行签名的散列算法。
*/
'algo' => env('JWT_ALGO', 'HS256'),
/*
|--------------------------------------------------------------------------
| Required Claims
|--------------------------------------------------------------------------
|
| Specify the required claims that must exist in any token.
| A TokenInvalidException will be thrown if any of these claims are not
| present in the payload.
|
|指定必须存在于任何令牌中的声明。
*/
'required_claims' => [
'iss',
'iat',
'exp',
'nbf',
'sub',
'jti',
],
/*
|--------------------------------------------------------------------------
| Persistent Claims
|--------------------------------------------------------------------------
|
| Specify the claim keys to be persisted when refreshing a token.
| `sub` and `iat` will automatically be persisted, in
| addition to the these claims.
|
| Note: If a claim does not exist then it will be ignored.
|
|指定在刷新令牌时要保留的声明密钥。
*/
'persistent_claims' => [
// 'foo',
// 'bar',
],
/*
|--------------------------------------------------------------------------
| Lock Subject
|--------------------------------------------------------------------------
|
| This will determine whether a `prv` claim is automatically added to
| the token. The purpose of this is to ensure that if you have multiple
| authentication models e.g. `App\User` & `App\OtherPerson`, then we
| should prevent one authentication request from impersonating another,
| if 2 tokens happen to have the same id across the 2 different models.
|
| Under specific circumstances, you may want to disable this behaviour
| e.g. if you only have one authentication model, then you would save
| a little on token size.
|
|
*/
'lock_subject' => true,
/*
|--------------------------------------------------------------------------
| Leeway
|--------------------------------------------------------------------------
|
| This property gives the jwt timestamp claims some "leeway".
| Meaning that if you have any unavoidable slight clock skew on
| any of your servers then this will afford you some level of cushioning.
|
| This applies to the claims `iat`, `nbf` and `exp`.
|
| Specify in seconds - only if you know you need it.
|
*/
'leeway' => env('JWT_LEEWAY', 0),
/*
|--------------------------------------------------------------------------
| Blacklist Enabled
|--------------------------------------------------------------------------
|
| In order to invalidate tokens, you must have the blacklist enabled.
| If you do not want or need this functionality, then set this to false.
|
| 为了使令牌无效,您必须启用黑名单。如果不想或不需要此功能,请将其设置为 false。
*/
'blacklist_enabled' => env('JWT_BLACKLIST_ENABLED', true),
/*
| -------------------------------------------------------------------------
| Blacklist Grace Period
| -------------------------------------------------------------------------
|
| When multiple concurrent requests are made with the same JWT,
| it is possible that some of them fail, due to token regeneration
| on every request.
|
| Set grace period in seconds to prevent parallel request failure.
|
| 当多个并发请求使用相同的JWT进行时,由于 access_token 的刷新 ,其中一些可能会失败,以秒为单位设置请求时间以防止并发的请求失败。
*/
'blacklist_grace_period' => env('JWT_BLACKLIST_GRACE_PERIOD', 0),
/*
|--------------------------------------------------------------------------
| Cookies encryption
|--------------------------------------------------------------------------
|
| By default Laravel encrypt cookies for security reason.
| If you decide to not decrypt cookies, you will have to configure Laravel
| to not encrypt your cookie token by adding its name into the $except
| array available in the middleware "EncryptCookies" provided by Laravel.
| see https://laravel.com/docs/master/responses#cookies-and-encryption
| for details.
|
| Set it to true if you want to decrypt cookies.
|
*/
'decrypt_cookies' => false,
/*
|--------------------------------------------------------------------------
| Providers
|--------------------------------------------------------------------------
|
| Specify the various providers used throughout the package.
|
| 指定整个包中使用的各种提供程序。
*/
'providers' => [
/*
|--------------------------------------------------------------------------
| JWT Provider
|--------------------------------------------------------------------------
|
| Specify the provider that is used to create and decode the tokens.
|
| 用于创建和解码令牌的提供程序。
*/
'jwt' => Tymon\JWTAuth\Providers\JWT\Lcobucci::class,
/*
|--------------------------------------------------------------------------
| Authentication Provider
|--------------------------------------------------------------------------
|
| Specify the provider that is used to authenticate users.
|
| 用于对用户进行身份验证的提供程序。
*/
'auth' => Tymon\JWTAuth\Providers\Auth\Illuminate::class,
/*
|--------------------------------------------------------------------------
| Storage Provider
|--------------------------------------------------------------------------
|
| Specify the provider that is used to store tokens in the blacklist.
|
| 用于在黑名单中存储标记的提供程序。
*/
'storage' => Tymon\JWTAuth\Providers\Storage\Illuminate::class,
],
];
调整配置
修改 config/auth.php
调整 guards
属性和 providers
属性
'guards' => [
'web' => [
'driver' => 'session',
'provider' => 'users',
],
'api' => [
'driver' => 'jwt',#把此处驱动改为jwt,默认为laravel框架自带的驱动token
'provider' => 'users',//注意此处根据自己的实际情况进行调整
],
],
'providers' => [
'users' => [
'driver' => 'eloquent',
'model' => App\Models\User::class,//用户模型,注意此处根据自己的实际情况进行调整
],
// 'users' => [
// 'driver' => 'database',
// 'table' => 'users',
// ],
],
生成 JWT 密钥
php artisan jwt:secret
这个密钥会在 env
文件里面生成一个 JWT_SECRET
参数
JWT_SECRET=h6aTNX8ZyQonEP2XXykS9G6RrElyIKEnLZtcAOa0AItdTifvTSRCjEL9DRkS8mcL
注册 auth.jwt 中间件
打开 app/Http/Kernel.php
文件,然后在 $routeMiddleware
属性里面添加这个类,如下:
protected $routeMiddleware = [
....
'auth.jwt' => \Tymon\JWTAuth\Http\Middleware\Authenticate::class,
];
创建控制器
使用 artisan
命令快速创建 AuthController
控制器
php artisan make:controller AuthController
官方案例,稍作了修改: login
登录,me
获取用户信息,logout
退出登录,refresh
刷新 token
,respondWithToken
返回 token
控制器完整代码:
<?php
namespace App\Http\Controllers;
use use App\Http\Requests\Api\AuthorizationRequest;
class AuthController extends Controller
{
/**
* Create a new AuthController instance.
* 要求附带email和password(数据来源users表)
* @return void
*/
public function __construct()
{
// 这里额外注意了:官方文档样例中只除外了『login』
// 这样的结果是,token 只能在有效期以内进行刷新,过期无法刷新
// 如果把 refresh 也放进去,token 即使过期但仍在刷新期以内也可刷新
// 不过刷新一次作废
$this->middleware('auth:api', ['except' => ['login']]);
// 另外关于上面的中间件,官方文档写的是『auth:api』
// 但是我推荐用 『jwt.auth』,效果是一样的,但是有更加丰富的报错信息返回
}
/**
* Get a JWT via given credentials.
* @param AuthorizationRequest $request
* @return \Illuminate\Http\JsonResponse
*/
public function login(AuthorizationRequest $request)
{
$credentials = request(['email', 'password']);
if (! $token = auth('api')->attempt($credentials)) {
return response()->json(['error' => 'Unauthorized'], 401);
}
return $this->respondWithToken($token);
}
/**
* Get the authenticated User.
*
* @return \Illuminate\Http\JsonResponse
*/
public function me()
{
return response()->json(auth('api')->user());
}
/**
* Log the user out (Invalidate the token).
*
* @return \Illuminate\Http\JsonResponse
*/
public function logout()
{
auth('api')->logout();
return response()->json(['message' => 'Successfully logged out']);
}
/**
* Refresh a token.
* 刷新token,如果开启黑名单,以前的token便会失效。
* 值得注意的是用上面的getToken再获取一次Token并不算做刷新,两次获得的Token是并行的,即两个都可用。
* @return \Illuminate\Http\JsonResponse
*/
public function refresh()
{
return $this->respondWithToken(auth('api')->refresh());
}
/**
* Get the token array structure.
*
* @param string $token
*
* @return \Illuminate\Http\JsonResponse
*/
protected function respondWithToken($token)
{
return response()->json([
'access_token' => $token,
'token_type' => 'bearer',
'expires_in' => auth('api')->factory()->getTTL() * 60
]);
}
}
Tip:参考里面的逻辑即可,因为每个业务需求不一样,所以需要做对应的修改~
jwt koken两种使用方式:
- 加到 url 中:?token=你的token
- 加到 header 中,建议用这种,因为在 https 情况下更安全:Authorization:Bearer 你的token
路由配置 JWT 中间件
<?php
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Route;
/*
|--------------------------------------------------------------------------
| API Routes
|--------------------------------------------------------------------------
|
| Here is where you can register API routes for your application. These
| routes are loaded by the RouteServiceProvider within a group which
| is assigned the "api" middleware group. Enjoy building your API!
|
*/
/*Route::middleware('auth:api')->get('/user', function (Request $request) {
return $request->user();
});*/
Route::post('register',[\App\Http\Controllers\Api\LoginController::class, 'register']);
Route::post('login',[\App\Http\Controllers\Api\LoginController::class, 'login']);
Route::middleware('auth.jwt')->group(function () {
Route::get('logout', [\App\Http\Controllers\Api\LoginController::class, 'logout']);
Route::get('refresh',[\App\Http\Controllers\Api\LoginController::class, 'refresh']);
});
Tip:这里的
auth.jwt
就是开头注册的中间件,即在app/Http/Kernel.php
文件的$routeMiddleware
属性中配置的名称
更新 User 模型
JWT
需要在 User
模型中实现 Tymon\JWTAuth\Contracts\JWTSubject
接口。 此接口需要实现两个方法 getJWTIdentifier
和 getJWTCustomClaims
。使用以下内容更新 app/User.php
<?php
namespace App;
use Illuminate\Foundation\Auth\User as Authenticatable;
use Illuminate\Notifications\Notifiable;
use Tymon\JWTAuth\Contracts\JWTSubject;
class User extends Authenticatable implements JWTSubject
{
use Notifiable;
protected $fillable = [
'name', 'email', 'password',
];
protected $hidden = [
'password', 'remember_token',
];
public function getJWTIdentifier()
{
return $this->getKey();
}
public function getJWTCustomClaims()
{
return [];
}
}
另一种无缝刷新 Token 的方法
创建中间件
php artisan make:middleware RefreshToken
完整代码:
<?php
namespace App\Http\Middleware;
use Closure;
use Tymon\JWTAuth\Exceptions\JWTException;
use Tymon\JWTAuth\Facades\JWTAuth;
use Tymon\JWTAuth\Http\Middleware\BaseMiddleware;
use Tymon\JWTAuth\Exceptions\TokenExpiredException;
use Symfony\Component\HttpKernel\Exception\UnauthorizedHttpException;
class RefreshToken extends BaseMiddleware
{
/**
* Handle an incoming request.
*
* @param \Illuminate\Http\Request $request
* @param \Closure $next
* @return mixed
*/
public function handle($request, Closure $next)
{
//检查请求中是否带有token 如果没有token值则抛出异常
$this->checkForToken($request);
try{
//从请求中获取token并且验证token是否过期 若是不过期则请求到控制器处理业务逻辑 若是过期则进行刷新
if ($request->user = JWTAuth::parseToken()->authenticate()) {
return $next($request);
}
throw new UnauthorizedHttpException('jwt-auth', '未登录');
}catch (TokenExpiredException $exception){
try{
//首先获得过期token 接着刷新token 再接着设置token并且验证token合法性
$token = JWTAuth::refresh(JWTAuth::getToken());
JWTAuth::setToken($token);
$request->user = JWTAuth::authenticate($token);
$request->headers->set('Authorization','Bearer '.$token); // token被刷新之后,保证本次请求在controller中需要根据token调取登录用户信息能够执行成功
}catch (JWTException $exception){
throw new UnauthorizedHttpException('jwt-auth', $exception->getMessage());
}
}
//将token值返回到请求头
return $this->setAuthenticationHeader($next($request), $token);
}
}
JWT配置说明
JWT Token
的三个时间,在 config/jwt.php
查看
- 有效时间
有效是指你获取Token
后,在多少时间内可以凭这个Token
去获取资源,逾期无效
'ttl' => env('JWT_TTL', 60), //单位分钟
- 刷新时间
刷新时间指的是在这个时间内可以凭旧Token
换取一个新Token
。例如Token
有效时间为 60 分钟,刷新时间为 20160 分钟,在 60 分钟内可以通过这个Token
获取新Token
,但是超过 60 分钟是不可以的,然后你可以一直循环获取,直到总时间超过 20160 分钟,不能再获取
'refresh_ttl' => env('JWT_REFRESH_TTL', 20160),
这里要强调的是,是否在刷新期可以一直用旧的 Token
获取新的 Token
,这个是由 blacklist_enabled
这个配置决定的,这个是指是否开启黑名单,默认是开启的,即刷新后,旧 Token
立马加入黑名单,不可在用。
- 宽限时间
宽限时间是为了解决并发请求的问题,假如宽限时间为 0s ,那么在新旧Token
交接的时候,并发请求就会出错,所以需要设定一个宽限时间,在宽限时间内,旧Token
仍然能够正常使用// 宽限时间需要开启黑名单(默认是开启的),黑名单保证过期token不可再用 'blacklist_enabled' => env('JWT_BLACKLIST_ENABLED', true) // 设定宽限时间,单位:秒 'blacklist_grace_period' => env('JWT_BLACKLIST_GRACE_PERIOD', 600)
在 Kernel 中注册中间件
/**
* The application's route middleware.
*
* These middleware may be assigned to groups or used individually.
*
* @var array
*/
protected $routeMiddleware = [
......
'auth.jwt' => \App\Http\Middleware\RefreshToken::class, //auth.jwt、RefreshToken均为博主自己取的名字 可以自行修改
];
Tip:这个中间件要替换之前的那个JWT中间件!!!
在路由中使用这个中间件就可以实现无缝刷新。
具体流程
前端只需要在请求的时候把那个 Token
值放在 Header
请求头里面携带过来,当这个 Token
值过期后,本次请求会被允许,后端会立即刷新出一条新的 Token
值,并交给响应头携带回来新的 Token
值,前端下次请求使用新的 Token
值即可,这样就可以实现无缝刷新了~