This project is a framework that provides an implementation of:

• JWS JSON Web Signature (RFC 7515),

• JWE JSON Web Encryption (RFC 7516),

• JWK JSON Web Key (RFC 7517).

• JWA JSON Web Algorithms (RFC 7518).

• JWT JSON Web Token (RFC 7519),

• JSON Web Key Thumbprint (RFC 7638).

• Unencoded Payload Option (RFC7797).

It also provides:

• a Symfony bundle

• a standalone console application

Licence

This project is release under MIT licence.

The framework has been successfully tested using PHP 7.1, PHP 7.2 and nightly with all algorithms.

Tests vectors from the RFC 7520 are fully implemented and all tests pass. Other test vector sources may be used (e.g. new algorithm specifications).

We also track bugs and code quality using Scrutinizer-CI and Sensio Insight.

Coding Standards are verified by StyleCI.

Code coverage is analyzed by Coveralls.io.

Supported Input Types:

JWS or JWE objects support every input that can be encoded into JSON:

• string, array, integer, float...

• Objects that implement the \JsonSerializable interface such as JWK or JWKSet

The detached payload is supported.

Supported Serialization Modes

• Compact JSON Serialization Syntax for JWS and JWE

• Flattened JSON Serialization Syntax for JWS and JWE

• General JSON Serialization Syntax for JWS and JWE

Supported Compression Methods

Supported Key Types (JWK)

JWK objects support JSON Web Key Thumbprint (RFC 7638).

Key Sets (JWKSet)

JWKSet is fully supported.

Supported Signature Algorithms

Supported Key Encryption Algorithms

Supported Content Encryption Algorithms

This framework needs at least:

• ,

• GMP extension.

• MBString extension.

Depending on the algorithms you using, other PHP extensions may be required (e.g. OpenSSL).

Please also consider the following optional requirements:

• If you intent to use EdDSA or ECDH-ES algorithm with Ed25519/X25519 curves on PHP 7.1, please install this third party extension

In version 2.1, an "Easy" component will be released. With this component you will be able to produce and consume tokens an easy way.

• Step 1: install the package web-token/jwt-easy

• Step 2: install the or algorithms you want to use. e.g., web-token/jwt-signature-algorithm-rsa. if you do not, you may encounter an error like "The algorithm "ES256" is not supported."

• Step 3: create your scripts.

JWS Creation And Verification

In the following example, we will create a signed token (JWS) with a set of standard and custom claims and headers.

A token you receive can be read and verified. Verification is done on the signature and the claims or header parameters you want.

If everything is ok, the variable $jwt contains a Jose\Easy\JWT object. This object has 2 properties: header and claims containing the loaded values.

JWE Creation And Decryption

The JWE creation and loading is very similar to the JWS process as they use common methods. In the following example, we will create an encrypted token (JWE) with a set of standard and custom claims and headers.

The encrypted tokens can be decrypted the same way as the signed ones.

If everything is ok, the variable $jwt contains a Jose\Easy\JWT object.

You can create a JWKSet object using three static methods:

• new JWKSet(array $keys): creates a JWKSet using a list of JWK objects.

• JWKSet::createFromJson(string $json): creates a JWKSet using a JSON object.

• JWKSet::createFromKeyData(array $values): creates a JWKSet using a decoded JSON object.

Hereafter all methods available for a JWKSet object. The variable $jwkset is a valid JWKSet object.

Requests for new features, bug fixed and all other ideas to make this framework useful are welcome. If you feel comfortable writing code, you could try to fix or .

Do not forget to .

If you think you have found a security issue, DO NOT open an issue. .