JWT Usage - First timer

Are you familiar with the OAuth2/OpenID Connect workflow? It answers most of your questions but maybe a bit more involved than using JWTs straight out of the box/package.

HI @primordial

What do you mean by

but maybe a bit more involved than using JWTs straight out of the box/package

No, i am not familiar with that workflow. Would you happen to have some good resources on this?

Many thanks

Not a quickie you are tackling a notable subject but there are lots of Laravel resources

https://knpuniversity.com/screencast/oauth

Hi @primordial and any others to whom it might concern. I have finished the first draft of my implementation and would like to share it here to get some feedback.

Some information in advance: I am using Sentinel instead of Auth and I am using tymons JWTAuth package.

Here goes:

I have defined a route that generates a token, based on the user like so

    public function authenticate(AuthenticationRequest $request) {
      if ($user = Sentinel::authenticate($request->toArray())) {
        $token = JWTAuth::fromUser($user);
        return response()->json(['token' => $token], 200);
      }
      else {
        return response()->json('Access Denied', 403);
      }
    }

I have another route to access a 'restricted' resource. To this route, I have applied custom middleware like so:

    public function handle($request, Closure $next)
    {
        /**
         * Custom middleware that performs the following actions:
         * - Grab the token
         * - Refresh the token (if still within refresh window)
         * - Grab the payload, based on the token
         * - Add the uuid of the user to the Request object (so we can grab the user in the controller)
         * - Add the new, refreshed token to the request so that we can return that in the json response
         */
        if (($token = JWTAuth::getToken()) && ($token = JWTAuth::refresh($token))
            && ($uuid = JWTAuth::getPayload($token)->get('sub'))) {
            $request->request->add(['uuid' => $uuid]);
            $request->request->add(['new_token' => $token]);
            return $next($request);
        }
    }

Then finally in my controller I return the restricted resources (the user profile in this case) like so:

    public function show(Request $request) {
      $user = User::where('uuid', '=', $request->get('uuid'))->first();
      $new_token = $request->get('new_token');
      return response()->json($user, 200)->header('Authentication' , 'Bearer '.$new_token);
    }

Currently i am using a POST request to the show() method, but maybe this could just as well be a GET request I suppose...?

I am open for all suggestions for improvement.

As a final note:

My approach here is to have a limited validity of each token (for example 1 hour, which is the default) and a limited window for refresh (24hours for example). As long as the token is expired BUT within the window for refresh, we will automatically deliver a new token. If the window for refresh has expired, the user will have to re-auth.

Many thanks in advance.

[EDIT] @tymondesigns , I hope that you dont mind me pinging you here directly, but since i am implementing your package, i would love to get your input on this as well.

Final Question: I would like to use RSA+SHA256 or RSA+SHA512 or ECDSA+SHA256 or ECDSA+SHA256. When looking at the jwt.php file this should be possible, correct? However i cannot really find any docu on how to set this up.

Many thanks again all!

ping? :)