Tp6 framework integrates JWT for token authentication

First step ：

Use the command to install

composer require lcobucci/jwt 3.3

The second step ：

Install the directory under the module for

app\business

The third step ：

Conduct JWT Package operation of

namespace app\business;
 
use Lcobucci\JWT\Signer\Hmac\Sha256;
use Lcobucci\JWT\Builder;
use Lcobucci\JWT\Parser;
use Lcobucci\JWT\ValidationData;
 
 
class JWT
{
    private static $_config = [
        'audience' => 'http://www.pyg.com',// recipient 
        'id' => '3f2g57a92aa',//token Unique identification of , Here is just a simple example 
        'sign' => 'pinyougou',// Signature key 
        'issuer' => 'http://adminapi.pyg.com',// Issued by people 
        'expire' => 3600*24 // The period of validity 
    ];
 
    // Generate token
    public static function getToken($user_id){
        // Signed by 
        $signer = new Sha256();
        // Get the current timestamp 
        $time = time();
        // Set signer 、 recipient 、 Unique identification 、 The issuance of time 、 Immediate effect 、 Expiration time 、 user id、 Signature 
        $token = (new Builder())->issuedBy(self::$_config['issuer'])
            ->canOnlyBeUsedBy(self::$_config['audience'])
            ->identifiedBy(self::$_config['id'], true)
            ->issuedAt($time)
            ->canOnlyBeUsedAfter($time-1)
            ->expiresAt($time + self::$_config['expire'])
            ->with('user_id', $user_id)
            ->sign($signer, self::$_config['sign'])
            ->getToken();
        return (string)$token;
    }
 
    // Get... From the requested information token token 
    public static function getRequestToken()
    {
        if (empty($_SERVER['HTTP_AUTHORIZATION'])) {
            return false;
        }
 
        $header = $_SERVER['HTTP_AUTHORIZATION'];
        $method = 'bearer';
        // Remove token There may be bearer identification 
        return trim(str_ireplace($method, '', $header));
    }
 
    // from token Get users id （ contain token The check ）
    public static function getUserId($token = null)
    {
        $user_id = null;
 
        $token = empty($token)?self::getRequestToken():$token;
 
        if (!empty($token)) {
            // For cancellation token  Add the following if Judging code 
            $delete_token = cache('delete_token') ?: [];
            if(in_array($token, $delete_token)){
                //token have been deleted （ Cancellation ）
                return $user_id;
            }
            $token = (new Parser())->parse((string) $token);
            // verification token
            $data = new ValidationData();
            $data->setIssuer(self::$_config['issuer']);// Issuer of verification 
            $data->setAudience(self::$_config['audience']);// Recipient of verification 
            $data->setId(self::$_config['id']);// verification token identification 
 
            if (!$token->validate($data)) {
                //token Validation failed 
                return $user_id;
            }
 
            // Verify the signature 
            $signer = new Sha256();
            if (!$token->verify($signer, self::$_config['sign'])) {
                // Signature verification failed 
                return $user_id;
            }
            // from token Get users id
            $user_id = $token->getClaim('user_id');
        }
 
        return $user_id;
    }
}

Step four ：

The request header Authorization

<IfModule mod_rewrite.c>
  Options +FollowSymlinks -Multiviews
  RewriteEngine On
 
  RewriteCond %{REQUEST_FILENAME} !-d
  RewriteCond %{REQUEST_FILENAME} !-f
  RewriteRule ^(.*)$ index.php/?s=$1 [QSA,PT,L]
  # Add the following 
  SetEnvIf Authorization .+ HTTP_AUTHORIZATION=$0
</IfModule>

Step five ： 

Establish middleware and verify

public $arr = ['login'];
public function handle($request, \Closure $next)
{
    if (!in_array($request->pathinfo(),$this->arr)) {
        $token = JWT::getRequestToken();
        if(empty($token))
        {
            return success('token Value is empty ');
        }else{
            try {
                $openid = JWT::getUserId($token);
                if(!$openid)
                {
                    return  success('token Mistake ');
                }
            }catch (\Exception $e)
            {
                return  success(' Failure ');
            }
        }
    }
    return $next($request);
}