https://github.com/flipboxfactory/craft-jwt
JWT for Craft CMS
https://github.com/flipboxfactory/craft-jwt
Last synced: about 1 year ago
JSON representation
JWT for Craft CMS
- Host: GitHub
- URL: https://github.com/flipboxfactory/craft-jwt
- Owner: flipboxfactory
- License: mit
- Created: 2018-03-20T23:03:07.000Z (about 8 years ago)
- Default Branch: master
- Last Pushed: 2022-02-14T19:35:15.000Z (over 4 years ago)
- Last Synced: 2025-04-18T05:21:34.821Z (about 1 year ago)
- Language: PHP
- Homepage:
- Size: 39.1 KB
- Stars: 11
- Watchers: 3
- Forks: 2
- Open Issues: 1
-
Metadata Files:
- Readme: README.md
- Changelog: CHANGELOG.md
- License: LICENSE
Awesome Lists containing this project
README
# JWT Tokens for Craft CMS
[](https://gitter.im/flipboxfactory/craft-jwt?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge&utm_content=badge)
[](https://github.com/flipboxfactory/craft-jwt/releases)
[](LICENSE.md)
[](https://travis-ci.com/flipboxfactory/craft-jwt)
[](https://scrutinizer-ci.com/g/flipboxfactory/craft-jwt/code-structure)
[](https://scrutinizer-ci.com/g/flipboxfactory/craft-jwt)
[](https://packagist.org/packages/flipboxfactory/craft-jwt)
JWT (JSON Web Token) for Craft CMS assists in issuing and claiming tokens. The intent is to issue a token which, at a later time, can be claimed and used to perform various actions.
The life of a JWT is defined upon creation and
## Use Cases
* Protected downloads
* Protected pages/content
* Authorization to API
* Tracking actions (by user)
* Sharing downloads/pages to guests
To learn more about JWT visit [JWT.IO](https://jwt.io/introduction/)
## Requirements
This plugin requires Craft CMS 3.0 or later.
## Installation
Simply run the following command from your project root:
```
composer require flipboxfactory/craft-jwt
```
Once the plugin is included in your project, navigate to the Control Panel, go to Settings → Plugins and click the “Install” button for the [JWT Plugin].
### Templating
The `craft.jwt` template variable provides access to the entire [JWT] plugin. To access the services, you may use:
Identity Service:
```twig
{% set token = craft.jwt.identity.issue(currentUser) %} {# To generate a token (store the identity) #}
{% set claim = craft.jwt.identity.claim(token|trim) %} {# To claim a token (retrieve the identity) #}
```
Route Service:
```twig
{% set token = craft.jwt.route.issue('action/path') %} {# To generate a token (store the action path) #}
{% set claim = craft.jwt.route.claim(token|trim) %} {# To claim a token (retrieve the action path) #}
```
## Examples
Common usages of this plugin are as follows:
### Self-Consumable API (Hybrid API - calling your own API)
Making calls to your own API is a great candidate for JWT Identity tokens. The flow works something like this:
1. Set a JavaScript variable: `let jwt = '{{ craft.jwt.identity.issue(currentUser) }}'`
2. Using [Axois](https://github.com/axios/axios) (or other HTTP client library), make a call to your own API using the JWT token created in step 1.
3. Apply the Authentication filter to your API controller(s).
```php
/**
* @inheritdoc
*/
public function behaviors()
{
return \craft\helpers\ArrayHelper::merge(
parent::behaviors(),
[
'authenticator' => [
'authMethods' => [
\flipbox\craft\jwt\filters\JwtHttpBearerAuth::class
]
]
]
);
}
```
A full example of the Authentication filter implementation can be found in our [RESTful API for Craft CMS](https://github.com/flipboxfactory/craft-restful/blob/master/src/controllers/AbstractController.php)
### Protected Downloads (or page access)
Perhaps a user needs to access a protected page or file download. To circumvent exposing the url publicly, issue a JWT Route token.
##### Render template:
```twig
{% set token = craft.jwt.route.issue(['templates/render', {'template': '_protected/template'}], currentUser)
{# the link will automatically render the template #}
View Protected Page
```
##### File Download
```twig
{% set asset = craft.assets.one() %}
{% set token = craft.jwt.route.issue(['assets/thumb', {'uid': asset.uid, width: 100, height: 100}], currentUser) %}
Download Protected File
```
Note: It's important to note that in the File Download example, we're also passing the `currentUser` param when generating
the token. As a result, when the action is processed we're assuming the identity of the user who issued the token prior to performing the action. This means a user
doesn't have to be logged in to Craft.
## Caution
JWTs created by this plugin are technically JWS (JSON Web Signature) tokens. The contents of a token can be
easily decoded and viewed using tools such as [jwt.io](https://jwt.io). It is important **NOT** to store sensitive data
in a token. The Craft '[security key](https://docs.craftcms.com/v3/installation.html#step-3-set-a-security-key)' is used to sign each token; ensuring the contents have not been
tampered with.
A token is valid for
## Contributing
Please see [CONTRIBUTING](https://github.com/flipboxfactory/craft-jwt/blob/master/CONTRIBUTING.md) for details.
## Credits
- [Flipbox Digital](https://github.com/flipbox)
## License
The MIT License (MIT). Please see [License File](https://github.com/flipboxfactory/craft-jwt/blob/master/LICENSE) for more information.
[Plugin Store]: https://plugins.craftcms.com/jwt
[JWT for Craft CMS]: https://github.com/flipboxfactory/craft-jwt
[JWT]: https://github.com/flipboxfactory/craft-jwt
[JWT Plugin]: https://github.com/flipboxfactory/craft-jwt