I should have probably update the progress that I had made with issue just in case anyone is still experiencing issues with jwt and
laravel. I would also like thank you guys for contributing to this discussion as It was all very helpful. While trying to build my api I found a few cool libraries that helped a lot with bootstraping my api on the server side was Dingo Api. Here is the link for their github. Read the docs it does a lot.
The following are some small snippet to demonstrate the implementation im using to refresh my jwt tokens.
Route definition
$api = app('Dingo\Api\Routing\Router');
$api->version('v1', function($api){
$api->get('token', 'App\Http\Controllers\AuthController@token');
});
Controller function that actually refreshes the token
//AuthController
public function token(){
$token = JWTAuth::getToken();
if(!$token){
throw new BadRequestHtttpException('Token not provided');
}
try{
$token = JWTAuth::refresh($token);
}catch(TokenInvalidException $e){
throw new AccessDeniedHttpException('The token is invalid');
}
return $this->response->withArray(['token'=>$token]);
}
For my client im using angularjs, so to automatically refreshes itself with the following code. Im using the angular-jwt library
angular.module('myapp',['angular-jwt','angular-storage'])
.config(['jwtInterceptorProvider', function(jwtInterceptorProvider){
jwtInterceptorProvider.tokenGetter = function(jwtHelper, $http,store) {
var jwt = store.get('jwt');
if(jwt){
if(jwtHelper.isTokenExpired(jwt)){
return $http({
url : 'api/token',
skipAuthorization : true,
method: 'GET',
headers : { Authorization : 'Bearer '+ jwt},
}).then(function(response){
store.set('jwt',response.data.token);
return response.data.token;
},function(response){
store.remove('jwt');
});
}else{
return jwt;
}
}
}
$httpProvider.interceptors.push('jwtInterceptor');
}]);
Im also using restangular to communicate with my backend. The app is not completed as there are a few things I might change about the the whole jwt auth process. For example I want to track the if a user is logged in and invalidate tokens if the user should reauthenticate themself. But for the time being this is what im using. I spent too much time on this part of the application and I am now currently working on the core parts of my application.
