Documentation

Jwt extends AbstractAuth
in package
uses AdapterUserTrait

Jwt auth class

Tags
category

Pop

author

Nick Sagona, III nick@popphp.org

copyright

Copyright (c) 2009-2026 Nick Sagona, III

license

https://www.popphp.org/license New BSD License

version
5.0.0

Table of Contents

Constants

ALGORITHMS  = ['HS256', 'RS256', 'ES256']
Supported algorithms
ES256_SIGNATURE_LENGTH  = 64
Expected byte length of a raw ES256 (P-256) JOSE signature: 32-byte R + 32-byte S (RFC 7518 §3.4)
NOT_VALID  = 0
Constant for auth result
VALID  = 1

Properties

$algorithm  : string
Algorithm
$audience  : string|null
Audience to validate the 'aud' claim against
$issuer  : string|null
Issuer to validate the 'iss' claim against
$key  : string
Key (shared secret for HS256, PEM public key for RS256/ES256)
$leeway  : int
Leeway (in seconds) allowed for exp/nbf claim comparisons
$needsRehash  : bool
Whether the last verified hash should be rehashed
$password  : string|null
Authentication password
$passwordField  : string
Password field
$result  : int
Authentication result
$user  : mixed
User data
$username  : string|null
Authentication username
$usernameField  : string
Username field

Methods

__construct()  : mixed
Constructor
authenticate()  : int
Method to authenticate
getPassword()  : string|null
Get the password
getPasswordField()  : string
Get the password field
getResult()  : int
Get the authentication result
getUser()  : mixed
Get the user record
getUsername()  : string|null
Get the username
getUsernameField()  : string
Get the username field
isAuthenticated()  : bool
Determine if the authentication attempt was successful
needsRehash()  : bool
Determine if the last verified hash should be rehashed
setAudience()  : Jwt
Set the audience to validate the 'aud' claim against
setIssuer()  : Jwt
Set the issuer to validate the 'iss' claim against
setLeeway()  : Jwt
Set the leeway (in seconds) allowed for exp/nbf claim comparisons
setPassword()  : AbstractAuth
Set the password
setPasswordField()  : static
Set the password field
setUsername()  : AbstractAuth
Set the username
setUsernameField()  : static
Set the username field
verify()  : bool
Method to verify a password against a hash
base64UrlDecode()  : string
Base64url-decode a JWT segment
claimsAreValid()  : bool
Determine if the token's claims (exp/nbf/aud/iss) are valid
derInteger()  : string
DER-encode a single ASN.1 INTEGER
derLength()  : string
DER-encode a length value
esSignatureToDer()  : string
Convert a JOSE ES256 raw R||S signature into the DER-encoded ASN.1 sequence openssl_verify() expects

Constants

ALGORITHMS

Supported algorithms

public array<string|int, mixed> ALGORITHMS = ['HS256', 'RS256', 'ES256']

ES256_SIGNATURE_LENGTH

Expected byte length of a raw ES256 (P-256) JOSE signature: 32-byte R + 32-byte S (RFC 7518 §3.4)

public int ES256_SIGNATURE_LENGTH = 64

NOT_VALID

Constant for auth result

public int NOT_VALID = 0

Properties

$algorithm

Algorithm

protected string $algorithm

$audience

Audience to validate the 'aud' claim against

protected string|null $audience = null

$issuer

Issuer to validate the 'iss' claim against

protected string|null $issuer = null

$key

Key (shared secret for HS256, PEM public key for RS256/ES256)

protected string $key

$leeway

Leeway (in seconds) allowed for exp/nbf claim comparisons

protected int $leeway = 0

$needsRehash

Whether the last verified hash should be rehashed

protected bool $needsRehash = false

$password

Authentication password

protected string|null $password = null

$passwordField

Password field

protected string $passwordField = 'password'

$username

Authentication username

protected string|null $username = null

$usernameField

Username field

protected string $usernameField = 'username'

Methods

__construct()

Constructor

public __construct(string $algorithm, string $key) : mixed

Instantiate the Jwt auth adapter object

Parameters
$algorithm : string
$key : string
Tags
throws
Exception

authenticate()

Method to authenticate

public authenticate(string $token[, string|null $secondary = null ]) : int
Parameters
$token : string
$secondary : string|null = null
Tags
throws
Exception
Return values
int

getPassword()

Get the password

public getPassword() : string|null
Return values
string|null

getPasswordField()

Get the password field

public getPasswordField() : string
Return values
string

getResult()

Get the authentication result

public getResult() : int
Return values
int

getUsername()

Get the username

public getUsername() : string|null
Return values
string|null

getUsernameField()

Get the username field

public getUsernameField() : string
Return values
string

isAuthenticated()

Determine if the authentication attempt was successful

public isAuthenticated() : bool
Return values
bool

needsRehash()

Determine if the last verified hash should be rehashed

public needsRehash() : bool
Return values
bool

setAudience()

Set the audience to validate the 'aud' claim against

public setAudience(string $audience) : Jwt
Parameters
$audience : string
Return values
Jwt

setIssuer()

Set the issuer to validate the 'iss' claim against

public setIssuer(string $issuer) : Jwt
Parameters
$issuer : string
Return values
Jwt

setLeeway()

Set the leeway (in seconds) allowed for exp/nbf claim comparisons

public setLeeway(int $seconds) : Jwt
Parameters
$seconds : int
Return values
Jwt

setPasswordField()

Set the password field

public setPasswordField(string $passwordField) : static
Parameters
$passwordField : string
Return values
static

setUsernameField()

Set the username field

public setUsernameField(string $usernameField) : static
Parameters
$usernameField : string
Return values
static

verify()

Method to verify a password against a hash

public verify(string $password, string $hash) : bool
Parameters
$password : string
$hash : string
Return values
bool

base64UrlDecode()

Base64url-decode a JWT segment

protected static base64UrlDecode(string $data) : string
Parameters
$data : string
Return values
string

claimsAreValid()

Determine if the token's claims (exp/nbf/aud/iss) are valid

protected claimsAreValid(array<string|int, mixed> $payload) : bool
Parameters
$payload : array<string|int, mixed>
Return values
bool

derInteger()

DER-encode a single ASN.1 INTEGER

protected static derInteger(string $bytes) : string
Parameters
$bytes : string
Return values
string

derLength()

DER-encode a length value

protected static derLength(int $length) : string
Parameters
$length : int
Return values
string

esSignatureToDer()

Convert a JOSE ES256 raw R||S signature into the DER-encoded ASN.1 sequence openssl_verify() expects

protected static esSignatureToDer(string $signature) : string
Parameters
$signature : string
Return values
string 

        

        
    




    

    

                                

                

                                
    

        On this page

        
    


                

                            

            

    

        

            
Search results