{"id":20701457,"url":"https://github.com/josepostiga/jwt-bouncer","last_synced_at":"2025-03-11T04:17:56.767Z","repository":{"id":45986495,"uuid":"293253675","full_name":"josepostiga/jwt-bouncer","owner":"josepostiga","description":"A JWT authorization guard for your Laravel/Lumen apps.","archived":false,"fork":false,"pushed_at":"2021-12-30T21:57:45.000Z","size":27,"stargazers_count":1,"open_issues_count":1,"forks_count":1,"subscribers_count":2,"default_branch":"master","last_synced_at":"2025-02-17T23:47:50.605Z","etag":null,"topics":["authorization","jwt","laravel","lumen","microservices","php"],"latest_commit_sha":null,"homepage":"","language":"PHP","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/josepostiga.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE.md","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2020-09-06T10:34:27.000Z","updated_at":"2021-02-14T23:12:29.000Z","dependencies_parsed_at":"2022-09-01T05:21:26.829Z","dependency_job_id":null,"html_url":"https://github.com/josepostiga/jwt-bouncer","commit_stats":null,"previous_names":[],"tags_count":6,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/josepostiga%2Fjwt-bouncer","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/josepostiga%2Fjwt-bouncer/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/josepostiga%2Fjwt-bouncer/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/josepostiga%2Fjwt-bouncer/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/josepostiga","download_url":"https://codeload.github.com/josepostiga/jwt-bouncer/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":242967518,"owners_count":20214282,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["authorization","jwt","laravel","lumen","microservices","php"],"created_at":"2024-11-17T00:41:52.842Z","updated_at":"2025-03-11T04:17:56.750Z","avatar_url":"https://github.com/josepostiga.png","language":"PHP","funding_links":[],"categories":[],"sub_categories":[],"readme":"# A JWT authorization guard for your Laravel/Lumen apps.\n\n[![Latest Version on Packagist](https://img.shields.io/packagist/v/josepostiga/jwt-bouncer.svg?style=flat-square)](https://packagist.org/packages/josepostiga/jwt-bouncer)\n![Run tests](https://github.com/josepostiga/jwt-bouncer/workflows/Run%20tests/badge.svg)\n[![Coverage Status](https://coveralls.io/repos/github/josepostiga/jwt-bouncer/badge.svg?branch=master)](https://coveralls.io/github/josepostiga/jwt-bouncer?branch=master)\n[![Total Downloads](https://img.shields.io/packagist/dt/josepostiga/jwt-bouncer.svg?style=flat-square)](https://packagist.org/packages/josepostiga/jwt-bouncer)\n\n## Installation\n\nYou can install the package via composer:\n\n```bash\ncomposer require josepostiga/jwt-bouncer\n```\n\nIf you're using a recent Laravel installation, this package is automatically discovered and wired by the framework. \n\nOn Lumen application, we need to manually add the `JosePostiga\\JwtBouncer\\JwtServiceProvider`.\n\n## Usage\n\n### The JWT auth guard\n\nThis package adds a `jwt` api guard to the framework's configuration. You can either explicitly select this guard on a per-route basis or change the default api guard driver to `jwt`, on you `config/auth.php` config file.\n\n### JWT Scopes\n\nThis package will validate the `scopes` claim on an incoming request's JWT, and check if the configured scopes are contained in that claim. If not, or if the claim isn't present, the request will be immediately rejected with a `401 Unauthorized` error status code. The same rejection will also happen if the JWT can't be correctly decoded.\n\n### Configuration\n\nIf we're using Laravel, we can publish the configuration file for the package by running `php artisan vendor:publish --tag=config`. A new `jwt-bouncer.php` config file will be available on the framework's `config` folder. Inside that file, we'll find two main configuration options: `guards` and `scopes`.\n\n* The `guards` option contains the necessary structure to be merged to the default `guards` keys on `config/auth.php`, which contains the authentication guards that the framework can use. If we need to rename the driver's key the package should reference to, this is where we'd do it.\n\n* The `scopes` key contains an array of pre-defined scopes the guard will be validating on every request's decoded JWT. We can add as many as necessary. **Tip:** If we want to accept all scopes, we'd add the `*` scope, here, which means that all scopes are accepted.\n\nIf we're using Lumen, then things get a little more tricky. We need to add a `JWT_SCOPES` key on the `.env` file, where we defined all the scopes we accept separated by a comma. We also need to add the auth configuration file load call in the `bootstrap/app.php` file, by adding `$app-\u003econfigure('auth')` on the configuration files load section, there.\n\n### Protecting routes\n\nAfter executing the configuration steps, we can call the `auth:jwt` middleware on any route, or route group, to use this package's guard.\n\n### The `Authenticatable` user instance\n\nOn a general Laravel application, we have access to the authenticated user instance via the `Auth::user()` or `request-\u003euser()`. This instance is, generally speaking, an instance of an Eloquent model or, in some cases, a resource from a users-like database table.\n\nWhen using this package's JWT guard, we'll also have access to the authenticated user, but it won't be any of the types described before. Instead, it'll be an instance of the `AuthenticatedUser` value object. This class implements the `Authenticatable` interface, but its source of data is the JWT itself.\n\nThis means that calling `Auth::user()-\u003eid()` will return the value of the JWT's `sub` claim. If we want to access any other claim in the JWT, we only need to reference it by its key name, so if we have a `name` claim, we can access it with `Auth::user()-\u003ename`. All calls to property access will be routed to the JWT's claims.\n\n### Testing\n\nThis project is fully tested. We have an [automatic pipeline](https://github.com/josepostiga/jwt-bouncer/actions) and an [automatic code quality analysis](https://coveralls.io/github/josepostiga/jwt-bouncer) tool set up to continuously test and assert the quality of all code published in this repository, but you can execute the test suite yourself by running the following command:\n\n``` bash\nvendor/bin/phpunit\n```\n\n**We aim to keep the master branch always deployable.** Exceptions may happen, but they should be extremely rare.\n\n## Changelog\n\nPlease see [CHANGELOG](CHANGELOG.md) for more information on what has changed recently.\n\n## Contributing\n\nPlease see [CONTRIBUTING](CONTRIBUTING.md) for details.\n\n## Security\n\nPlease see [SECURITY](SECURITY.md) for details.\n\n## Credits\n\n- [José Postiga](https://github.com/josepostiga)\n- [All Contributors](../../contributors)\n\n## License\n\nPlease see [LICENSE](LICENSE.md) for details.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjosepostiga%2Fjwt-bouncer","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fjosepostiga%2Fjwt-bouncer","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjosepostiga%2Fjwt-bouncer/lists"}