This framework needs at least:

• PHP 8.1+,

• Extensions:

  • MBString

  • JSON

Depending on the algorithms you using, other PHP extensions may be required (e.g. OpenSSL, Sodium).

Please note that cypher operation may be really slow, especially RSA functions. It is highly recommended to enable GMP or BCMath.

Supported Input Types:

JWS or JWE objects support every input that can be encoded into JSON:

• string, array, integer, float...

• Objects that implement the \JsonSerializable interface such as JWK or JWKSet

The detached payload is supported.

Supported Serialization Modes

Supported Compression Methods

Supported Key Types (JWK)

JWK objects support JSON Web Key Thumbprint (RFC 7638).

Key Sets (JWKSet)

JWKSet is fully supported.

Supported Signature Algorithms

Supported Key Encryption Algorithms

Supported Content Encryption Algorithms

The framework has been successfully tested using PHP 8.1 with all algorithms.

Tests vectors from the are fully implemented and all tests pass. Other test vector sources may be used (e.g. new algorithm specifications).

We also track bugs and code quality using PHPStan and several extensions.

Coding Standards are verified by Easy Coding Standards.

Requests for new features, bug fixed and all other ideas to make this framework useful are welcome. If you feel comfortable writing code, you could try to fix or .

Do not forget to .

If you think you have found a security issue, DO NOT open an issue. .

This project is a framework that provides an implementation of:

• JWS ,

• JWE ,

• JWK .

• JWA .

• JWT ,

• JSON Web Key Thumbprint ().

• Unencoded Payload Option ().

It also provides:

• a Symfony bundle

• a standalone console application

Licence

This project is release under .

For each cryptographic operation, you will need at least one algorithm and one key.

The algorithm list depends on the cypher operation to be performed (signature or encryption).

These algorithms are managed by an Algorithm Manager. In the following example, we will create an algorithm manager that will handle two algorithms: PS256 and ES512.

The algorithm management is part of the web-token/jwt-core component. The signature algorithms are available in dedicated packages. See or algorithm pages for more information.

Algorithm Manager Factory

Your application may need several algorithm managers for several use cases. For example you application may use JWT for:

• signed events,

• authentication tokens.

To avoid mixing algorithms in one algorithm manager or instantiate several times the same algorithms, this framework provides an Algorithm Manager Factory.

This factory will create algorithm managers on demand. It allows the same algorithm to be instantiated multiple times but with different configuration options.

Each algorithm is identified using an alias.

The first argument of the method add is the alias for the algorithm. It must be unique. In general, this alias corresponds to the algorithm name.

As you can see in the example, we added the algorithm PBES2-HS512+A256KW twice:

• with the default configuration,

• with custom arguments.

Now our algorithm manager factory is ready. We can create several algorithm managers by passing a list of aliases to the method create: