PHPのJWTライブラリについて調べてみた

調査対象

  • firebase/php-jwt
  • lcobucci/jwt
  • web-token/jwt-framework
  • kelvinmo/simplejwt
  • sop/jwx

調査結果

firebase/php-jwt

https://packagist.org/packages/firebase/php-jwt

最新バージョン: v6.4.0 2023-02-09 21:01 UTC

php: ^7.1||^8.0

JWS: ○ JWE: × JWK: ○

サンプルコード
JWS HS256
$key = 'example_key';
$payload = [
    'iss' => 'http://example.org',
    'aud' => 'http://example.com',
    'iat' => 1356999524,
    'nbf' => 1357000000
];

$jwt = JWT::encode($payload, $key, 'HS256');

$decoded = JWT::decode($jwt, new Key($key, 'HS256'));
サンプルコード
JWS RS256
$privateKey = <<<EOD
-----BEGIN RSA PRIVATE KEY-----
MIIEowIBAAKCAQEAuzWHNM5f+amCjQztc5QTfJfzCC5J4nuW+L/aOxZ4f8J3Frew
M2c/dufrnmedsApb0By7WhaHlcqCh/ScAPyJhzkPYLae7bTVro3hok0zDITR8F6S
JGL42JAEUk+ILkPI+DONM0+3vzk6Kvfe548tu4czCuqU8BGVOlnp6IqBHhAswNMM
78pos/2z0CjPM4tbeXqSTTbNkXRboxjU29vSopcT51koWOgiTf3C7nJUoMWZHZI5
HqnIhPAG9yv8HAgNk6CMk2CadVHDo4IxjxTzTTqo1SCSH2pooJl9O8at6kkRYsrZ
WwsKlOFE2LUce7ObnXsYihStBUDoeBQlGG/BwQIDAQABAoIBAFtGaOqNKGwggn9k
6yzr6GhZ6Wt2rh1Xpq8XUz514UBhPxD7dFRLpbzCrLVpzY80LbmVGJ9+1pJozyWc
VKeCeUdNwbqkr240Oe7GTFmGjDoxU+5/HX/SJYPpC8JZ9oqgEA87iz+WQX9hVoP2
oF6EB4ckDvXmk8FMwVZW2l2/kd5mrEVbDaXKxhvUDf52iVD+sGIlTif7mBgR99/b
c3qiCnxCMmfYUnT2eh7Vv2LhCR/G9S6C3R4lA71rEyiU3KgsGfg0d82/XWXbegJW
h3QbWNtQLxTuIvLq5aAryV3PfaHlPgdgK0ft6ocU2de2FagFka3nfVEyC7IUsNTK
bq6nhAECgYEA7d/0DPOIaItl/8BWKyCuAHMss47j0wlGbBSHdJIiS55akMvnAG0M
39y22Qqfzh1at9kBFeYeFIIU82ZLF3xOcE3z6pJZ4Dyvx4BYdXH77odo9uVK9s1l
3T3BlMcqd1hvZLMS7dviyH79jZo4CXSHiKzc7pQ2YfK5eKxKqONeXuECgYEAyXlG
vonaus/YTb1IBei9HwaccnQ/1HRn6MvfDjb7JJDIBhNClGPt6xRlzBbSZ73c2QEC
6Fu9h36K/HZ2qcLd2bXiNyhIV7b6tVKk+0Psoj0dL9EbhsD1OsmE1nTPyAc9XZbb
OPYxy+dpBCUA8/1U9+uiFoCa7mIbWcSQ+39gHuECgYAz82pQfct30aH4JiBrkNqP
nJfRq05UY70uk5k1u0ikLTRoVS/hJu/d4E1Kv4hBMqYCavFSwAwnvHUo51lVCr/y
xQOVYlsgnwBg2MX4+GjmIkqpSVCC8D7j/73MaWb746OIYZervQ8dbKahi2HbpsiG
8AHcVSA/agxZr38qvWV54QKBgCD5TlDE8x18AuTGQ9FjxAAd7uD0kbXNz2vUYg9L
hFL5tyL3aAAtUrUUw4xhd9IuysRhW/53dU+FsG2dXdJu6CxHjlyEpUJl2iZu/j15
YnMzGWHIEX8+eWRDsw/+Ujtko/B7TinGcWPz3cYl4EAOiCeDUyXnqnO1btCEUU44
DJ1BAoGBAJuPD27ErTSVtId90+M4zFPNibFP50KprVdc8CR37BE7r8vuGgNYXmnI
RLnGP9p3pVgFCktORuYS2J/6t84I3+A17nEoB4xvhTLeAinAW/uTQOUmNicOP4Ek
2MsLL2kHgL8bLTmvXV4FX+PXphrDKg1XxzOYn0otuoqdAQrkK4og
-----END RSA PRIVATE KEY-----
EOD;

$publicKey = <<<EOD
-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAuzWHNM5f+amCjQztc5QT
fJfzCC5J4nuW+L/aOxZ4f8J3FrewM2c/dufrnmedsApb0By7WhaHlcqCh/ScAPyJ
hzkPYLae7bTVro3hok0zDITR8F6SJGL42JAEUk+ILkPI+DONM0+3vzk6Kvfe548t
u4czCuqU8BGVOlnp6IqBHhAswNMM78pos/2z0CjPM4tbeXqSTTbNkXRboxjU29vS
opcT51koWOgiTf3C7nJUoMWZHZI5HqnIhPAG9yv8HAgNk6CMk2CadVHDo4IxjxTz
TTqo1SCSH2pooJl9O8at6kkRYsrZWwsKlOFE2LUce7ObnXsYihStBUDoeBQlGG/B
wQIDAQAB
-----END PUBLIC KEY-----
EOD;

$payload = [
    'iss' => 'example.org',
    'aud' => 'example.com',
    'iat' => 1356999524,
    'nbf' => 1357000000
];

$jwt = JWT::encode($payload, $privateKey, 'RS256');

$decoded = JWT::decode($jwt, new Key($publicKey, 'RS256'));
ソースサイズ
$ phploc src/
phploc 7.0.2 by Sebastian Bergmann.

Size
  Lines of Code (LOC)                             1308
  Comment Lines of Code (CLOC)                     415 (31.73%)
  Non-Comment Lines of Code (NCLOC)                893 (68.27%)
  Logical Lines of Code (LLOC)                     277 (21.18%)
    Classes                                        277 (100.00%)
      Average Class Length                          39
        Minimum Class Length                         0
        Maximum Class Length                       140
      Average Method Length                          6
        Minimum Method Length                        1
        Maximum Method Length                       22
      Average Methods Per Class                      5
        Minimum Methods Per Class                    0
        Maximum Methods Per Class                   16
    Functions                                        0 (0.00%)
      Average Function Length                        0
    Not in classes or functions                      0 (0.00%)

Cyclomatic Complexity
  Average Complexity per LLOC                     0.46
  Average Complexity per Class                   19.14
    Minimum Class Complexity                      1.00
    Maximum Class Complexity                     74.00
  Average Complexity per Method                   4.53
    Minimum Method Complexity                     1.00
    Maximum Method Complexity                    20.00

Dependencies
  Global Accesses                                    0
    Global Constants                                 0 (0.00%)
    Global Variables                                 0 (0.00%)
    Super-Global Variables                           0 (0.00%)
  Attribute Accesses                                73
    Non-Static                                      63 (86.30%)
    Static                                          10 (13.70%)
  Method Calls                                      77
    Non-Static                                      27 (35.06%)
    Static                                          50 (64.94%)

Structure
  Namespaces                                         1
  Interfaces                                         0
  Traits                                             0
  Classes                                            7
    Abstract Classes                                 0 (0.00%)
    Concrete Classes                                 7 (100.00%)
      Final Classes                                  0 (0.00%)
      Non-Final Classes                              7 (100.00%)
  Methods                                           36
    Scope
      Non-Static Methods                            13 (36.11%)
      Static Methods                                23 (63.89%)
    Visibility
      Public Methods                                18 (50.00%)
      Protected Methods                              0 (0.00%)
      Private Methods                               18 (50.00%)
  Functions                                          0
    Named Functions                                  0 (0.00%)
    Anonymous Functions                              0 (0.00%)
  Constants                                          8
    Global Constants                                 0 (0.00%)
    Class Constants                                  8 (100.00%)
      Public Constants                               0 (0.00%)
      Non-Public Constants                           8 (100.00%)

lcobucci/jwt

https://packagist.org/packages/lcobucci/jwt

最新バージョン: 5.0.0 2023-02-25 21:35 UTC

php: ~8.1.0 || ~8.2.0

JWS: ○ JWE: × JWK: ×

サンプルコード
JWS
$key = InMemory::base64Encoded(
    'hiG8DlOKvtih6AxlZn5XKImZ06yu8I3mkOzaJrEuW8yAv8Jnkw330uMt8AEqQ5LB'
);

$token = (new JwtFacade())->issue(
    new Sha256(),
    $key,
    static fn (
        Builder $builder,
        DateTimeImmutable $issuedAt
    ): Builder => $builder
        ->issuedBy('https://api.my-awesome-app.io')
        ->permittedFor('https://client-app.io')
        ->expiresAt($issuedAt->modify('+10 minutes'))
);

$jwt = 'eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpYXQiOjE2NTg2OTYwNTIsIm5iZiI6MT'
    . 'Y1ODY5NjA1MiwiZXhwIjoxNjU4Njk2NjUyLCJpc3MiOiJodHRwczovL2FwaS5teS1hd2Vzb'
    . '21lLWFwcC5pbyIsImF1ZCI6Imh0dHBzOi8vY2xpZW50LWFwcC5pbyJ9.yzxpjyq8lXqMgaN'
    . 'rMEOLUr7R0brvhwXx0gp56uWEIfc';

$token = (new JwtFacade())->parse(
    $jwt,
    new Constraint\SignedWith(new Sha256(), $key),
    new Constraint\StrictValidAt(
        new FrozenClock(new DateTimeImmutable('2022-07-24 20:55:10+00:00'))
    )
);
ソースサイズ
$ phploc src
phploc 7.0.2 by Sebastian Bergmann.

Directories                                          9
Files                                               69

Size
  Lines of Code (LOC)                             2977
  Comment Lines of Code (CLOC)                     438 (14.71%)
  Non-Comment Lines of Code (NCLOC)               2539 (85.29%)
  Logical Lines of Code (LLOC)                     419 (14.07%)
    Classes                                        419 (100.00%)
      Average Class Length                           6
        Minimum Class Length                         0
        Maximum Class Length                        41
      Average Method Length                          1
        Minimum Method Length                        0
        Maximum Method Length                       12
      Average Methods Per Class                      3
        Minimum Methods Per Class                    0
        Maximum Methods Per Class                   14
    Functions                                        0 (0.00%)
      Average Function Length                        0
    Not in classes or functions                      0 (0.00%)

Cyclomatic Complexity
  Average Complexity per LLOC                     0.24
  Average Complexity per Class                    2.46
    Minimum Class Complexity                      1.00
    Maximum Class Complexity                     16.00
  Average Complexity per Method                   1.52
    Minimum Method Complexity                     1.00
    Maximum Method Complexity                     5.00

Dependencies
  Global Accesses                                    0
    Global Constants                                 0 (0.00%)
    Global Variables                                 0 (0.00%)
    Super-Global Variables                           0 (0.00%)
  Attribute Accesses                                86
    Non-Static                                      86 (100.00%)
    Static                                           0 (0.00%)
  Method Calls                                     220
    Non-Static                                     141 (64.09%)
    Static                                          79 (35.91%)

Structure
  Namespaces                                        10
  Interfaces                                        16
  Traits                                             0
  Classes                                           53
    Abstract Classes                                 4 (7.55%)
    Concrete Classes                                49 (92.45%)
      Final Classes                                 49 (100.00%)
      Non-Final Classes                              0 (0.00%)
  Methods                                          238
    Scope
      Non-Static Methods                           196 (82.35%)
      Static Methods                                42 (17.65%)
    Visibility
      Public Methods                               201 (84.45%)
      Protected Methods                              5 (2.10%)
      Private Methods                               32 (13.45%)
  Functions                                          3
    Named Functions                                  0 (0.00%)
    Anonymous Functions                              3 (100.00%)
  Constants                                         42
    Global Constants                                 0 (0.00%)
    Class Constants                                 42 (100.00%)
      Public Constants                              30 (71.43%)
      Non-Public Constants                          12 (28.57%)

web-token/jwt-framework

https://packagist.org/packages/web-token/jwt-framework

最新バージョン: 3.1.7 2023-03-11 14:35 UTC

php: >=8.1

JWS: ○ JWE: ○ JWK: ○

サンプルコード
JWS HS256
// The algorithm manager with the HS256 algorithm.
$algorithmManager = new AlgorithmManager([
    new HS256(),
]);

// Our key.
$jwk = new JWK([
    'kty' => 'oct',
    'k' => 'dzI6nbW4OcNF-AtfxGAmuyz7IpHRudBI0WgGjZWgaRJt6prBn3DARXgUR8NVwKhfL43QBIU2Un3AvCGCHRgY4TbEqhOi8-i98xxmCggNjde4oaW6wkJ2NgM3Ss9SOX9zS3lcVzdCMdum-RwVJ301kbin4UtGztuzJBeg5oVN00MGxjC2xWwyI0tgXVs-zJs5WlafCuGfX1HrVkIf5bvpE0MQCSjdJpSeVao6-RSTYDajZf7T88a2eVjeW31mMAg-jzAWfUrii61T_bYPJFOXW8kkRWoa1InLRdG6bKB9wQs9-VdXZP60Q4Yuj_WZ-lO7qV9AEFrUkkjpaDgZT86w2g',
]);

// We instantiate our JWS Builder.
$jwsBuilder = new JWSBuilder($algorithmManager);

// The payload we want to sign. The payload MUST be a string hence we use our JSON Converter.
$payload = json_encode([
    'iat' => time(),
    'nbf' => time(),
    'exp' => time() + 3600,
    'iss' => 'My service',
    'aud' => 'Your application',
]);

$jws = $jwsBuilder
    ->create()                               // We want to create a new JWS
    ->withPayload($payload)                  // We set the payload
    ->addSignature($jwk, ['alg' => 'HS256']) // We add a signature with a simple protected header
    ->build();                               // We build it
// The algorithm manager with the HS256 algorithm.
$algorithmManager = new AlgorithmManager([
    new HS256(),
]);

// We instantiate our JWS Verifier.
$jwsVerifier = new JWSVerifier(
    $algorithmManager
);

// Our key.
$jwk = new JWK([
    'kty' => 'oct',
    'k' => 'dzI6nbW4OcNF-AtfxGAmuyz7IpHRudBI0WgGjZWgaRJt6prBn3DARXgUR8NVwKhfL43QBIU2Un3AvCGCHRgY4TbEqhOi8-i98xxmCggNjde4oaW6wkJ2NgM3Ss9SOX9zS3lcVzdCMdum-RwVJ301kbin4UtGztuzJBeg5oVN00MGxjC2xWwyI0tgXVs-zJs5WlafCuGfX1HrVkIf5bvpE0MQCSjdJpSeVao6-RSTYDajZf7T88a2eVjeW31mMAg-jzAWfUrii61T_bYPJFOXW8kkRWoa1InLRdG6bKB9wQs9-VdXZP60Q4Yuj_WZ-lO7qV9AEFrUkkjpaDgZT86w2g',
]);

// The serializer manager. We only use the JWS Compact Serialization Mode.
$serializerManager = new JWSSerializerManager([
    new CompactSerializer(),
]);

// The input we want to check
$token = 'eyJhbGciOiJIUzI1NiJ9.eyJpYXQiOjE1MDc4OTY5OTIsIm5iZiI6MTUwNzg5Njk5MiwiZXhwIjoxNTA3OTAwNTkyLCJpc3MiOiJNeSBzZXJ2aWNlIiwiYXVkIjoiWW91ciBhcHBsaWNhdGlvbiJ9.eycp9PTdgO4WA-68-AMoHPwsKDr68NhjIQKz4lUkiI0';

// We try to load the token.
$jws = $serializerManager->unserialize($token);

// We verify the signature. This method does NOT check the header.
// The arguments are:
// - The JWS object,
// - The key,
// - The index of the signature to check. See 
$isVerified = $jwsVerifier->verifyWithKey($jws, $jwk, 0);
JWE
// The key encryption algorithm manager with the A256KW algorithm.
$keyEncryptionAlgorithmManager = new AlgorithmManager([
    new A256KW(),
]);

// The content encryption algorithm manager with the A256CBC-HS256 algorithm.
$contentEncryptionAlgorithmManager = new AlgorithmManager([
    new A256CBCHS512(),
]);

// The compression method manager with the DEF (Deflate) method.
$compressionMethodManager = new CompressionMethodManager([
    new Deflate(),
]);

// We instantiate our JWE Builder.
$jweBuilder = new JWEBuilder(
    $keyEncryptionAlgorithmManager,
    $contentEncryptionAlgorithmManager,
    $compressionMethodManager
);

// Our key.
$jwk = new JWK([
    'kty' => 'oct',
    'k' => 'dzI6nbW4OcNF-AtfxGAmuyz7IpHRudBI0WgGjZWgaRJt6prBn3DARXgUR8NVwKhfL43QBIU2Un3AvCGCHRgY4TbEqhOi8-i98xxmCggNjde4oaW6wkJ2NgM3Ss9SOX9zS3lcVzdCMdum-RwVJ301kbin4UtGztuzJBeg5oVN00MGxjC2xWwyI0tgXVs-zJs5WlafCuGfX1HrVkIf5bvpE0MQCSjdJpSeVao6-RSTYDajZf7T88a2eVjeW31mMAg-jzAWfUrii61T_bYPJFOXW8kkRWoa1InLRdG6bKB9wQs9-VdXZP60Q4Yuj_WZ-lO7qV9AEFrUkkjpaDgZT86w2g',
]);

// The payload we want to encrypt. It MUST be a string.
$payload = json_encode([
    'iat' => time(),
    'nbf' => time(),
    'exp' => time() + 3600,
    'iss' => 'My service',
    'aud' => 'Your application',
]);

$jwe = $jweBuilder
    ->create()              // We want to create a new JWE
    ->withPayload($payload) // We set the payload
    ->withSharedProtectedHeader([
        'alg' => 'A256KW',        // Key Encryption Algorithm
        'enc' => 'A256CBC-HS512', // Content Encryption Algorithm
        'zip' => 'DEF'            // We enable the compression (irrelevant as the payload is small, just for the example).
    ])
    ->addRecipient($jwk)    // We add a recipient (a shared key or public key).
    ->build();              // We build it
// The key encryption algorithm manager with the A256KW algorithm.
$keyEncryptionAlgorithmManager = new AlgorithmManager([
    new A256KW(),
]);

// The content encryption algorithm manager with the A256CBC-HS256 algorithm.
$contentEncryptionAlgorithmManager = new AlgorithmManager([
    new A256CBCHS512(),
]);

// The compression method manager with the DEF (Deflate) method.
$compressionMethodManager = new CompressionMethodManager([
    new Deflate(),
]);

// We instantiate our JWE Decrypter.
$jweDecrypter = new JWEDecrypter(
    $keyEncryptionAlgorithmManager,
    $contentEncryptionAlgorithmManager,
    $compressionMethodManager
);

// Our key.
$jwk = JWK::create([
    'kty' => 'oct',
    'k' => 'dzI6nbW4OcNF-AtfxGAmuyz7IpHRudBI0WgGjZWgaRJt6prBn3DARXgUR8NVwKhfL43QBIU2Un3AvCGCHRgY4TbEqhOi8-i98xxmCggNjde4oaW6wkJ2NgM3Ss9SOX9zS3lcVzdCMdum-RwVJ301kbin4UtGztuzJBeg5oVN00MGxjC2xWwyI0tgXVs-zJs5WlafCuGfX1HrVkIf5bvpE0MQCSjdJpSeVao6-RSTYDajZf7T88a2eVjeW31mMAg-jzAWfUrii61T_bYPJFOXW8kkRWoa1InLRdG6bKB9wQs9-VdXZP60Q4Yuj_WZ-lO7qV9AEFrUkkjpaDgZT86w2g',
]);

// The serializer manager. We only use the JWE Compact Serialization Mode.
$serializerManager = new JWESerializerManager([
    new CompactSerializer(),
]);

// The input we want to decrypt
$token = 'eyJhbGciOiJBMjU2S1ciLCJlbmMiOiJBMjU2Q0JDLUhTNTEyIiwiemlwIjoiREVGIn0.9RLpf3Gauf05QPNCMzPcH4XNBLmH0s3e-YWwOe57MTG844gnc-g2ywfXt_R0Q9qsR6WhkmQEhdLk2CBvfqr4ob4jFlvJK0yW.CCvfoTKO9tQlzCvbAuFAJg.PxrDlsbSRcxC5SuEJ84i9E9_R3tCyDQsEPTIllSCVxVcHiPOC2EdDlvUwYvznirYP6KMTdKMgLqxB4BwI3CWtys0fceSNxrEIu_uv1WhzJg.4DnyeLEAfB4I8Eq0UobnP8ymlX1UIfSSADaJCXr3RlU';

// We try to load the token.
$jwe = $serializerManager->unserialize($token);

// We decrypt the token. This method does NOT check the header.
$success = $jweDecrypter->decryptUsingKey($jwe, $jwk, 0);
ソースサイズ
$ phploc src
phploc 7.0.2 by Sebastian Bergmann.

Directories                                         59
Files                                              375

Size
  Lines of Code (LOC)                            22879
  Comment Lines of Code (CLOC)                    2497 (10.91%)
  Non-Comment Lines of Code (NCLOC)              20382 (89.09%)
  Logical Lines of Code (LLOC)                    3943 (17.23%)
    Classes                                       3722 (94.40%)
      Average Class Length                          10
        Minimum Class Length                         0
        Maximum Class Length                       145
      Average Method Length                          2
        Minimum Method Length                        0
        Maximum Method Length                       31
      Average Methods Per Class                      4
        Minimum Methods Per Class                    0
        Maximum Methods Per Class                   29
    Functions                                      221 (5.60%)
      Average Function Length                        5
    Not in classes or functions                      0 (0.00%)

Cyclomatic Complexity
  Average Complexity per LLOC                     0.33
  Average Complexity per Class                    4.79
    Minimum Class Complexity                      1.00
    Maximum Class Complexity                     65.00
  Average Complexity per Method                   1.96
    Minimum Method Complexity                     1.00
    Maximum Method Complexity                    14.00

Dependencies
  Global Accesses                                    0
    Global Constants                                 0 (0.00%)
    Global Variables                                 0 (0.00%)
    Super-Global Variables                           0 (0.00%)
  Attribute Accesses                               719
    Non-Static                                     719 (100.00%)
    Static                                           0 (0.00%)
  Method Calls                                    3377
    Non-Static                                    2807 (83.12%)
    Static                                         570 (16.88%)

Structure
  Namespaces                                        41
  Interfaces                                        25
  Traits                                             0
  Classes                                          315
    Abstract Classes                                25 (7.94%)
    Concrete Classes                               290 (92.06%)
      Final Classes                                203 (70.00%)
      Non-Final Classes                             87 (30.00%)
  Methods                                         1399
    Scope
      Non-Static Methods                          1248 (89.21%)
      Static Methods                               151 (10.79%)
    Visibility
      Public Methods                              1001 (71.55%)
      Protected Methods                            194 (13.87%)
      Private Methods                              204 (14.58%)
  Functions                                         40
    Named Functions                                  0 (0.00%)
    Anonymous Functions                             40 (100.00%)
  Constants                                         64
    Global Constants                                 0 (0.00%)
    Class Constants                                 64 (100.00%)
      Public Constants                              49 (76.56%)
      Non-Public Constants                          15 (23.44%)

kelvinmo/simplejwt

https://packagist.org/packages/kelvinmo/simplejwt

最新バージョン: v0.7.0 2022-11-25 21:25 UTC

php: ^7.1 || ^8.0

JWS: ○ JWE: ○ JWK: ○

サンプルコード
JWS HS256
$set = new SimpleJWT\Keys\KeySet();
$key = new SimpleJWT\Keys\SymmetricKey('secret123', 'bin');
$set->add($key);

// Note $headers['alg'] is required
$headers = ['alg' => 'HS256', 'typ' => 'JWT'];
$claims = ['iss' => 'me', 'exp' => 1234567];
$jwt = new SimpleJWT\JWT($headers, $claims);

try {
    print $jwt->encode($set);
} catch (\RuntimeException $e) {

}

try {
    $jwt = SimpleJWT\JWT::decode('abc.def.ghigjghr', $set, 'HS256');
} catch (SimpleJWT\InvalidTokenException $e) {

}
JWE
// Note $headers['alg'] and $headers['enc'] are required
$headers = ['alg' => 'PBES2-HS256+A128KW', 'enc' => 'A128CBC-HS256'];
$plaintext = 'This is the plaintext I want to encrypt.';
$jwt = new SimpleJWT\JWE($headers, $plaintext);

try {
    print $jwt->encrypt($set);
} catch (\RuntimeException $e) {

}

try {
    $jwt = SimpleJWT\JWE::decrypt('abc.def.ghi.klm.nop', $set, 'PBES2-HS256+A128KW');
} catch (SimpleJWT\InvalidTokenException $e) {

}

print $jwt->getHeader('alg');
print $jwt->getPlaintext();
ソースサイズ
$ phploc src
phploc 7.0.2 by Sebastian Bergmann.

Directories                                          7
Files                                               38

Size
  Lines of Code (LOC)                             6467
  Comment Lines of Code (CLOC)                    2987 (46.19%)
  Non-Comment Lines of Code (NCLOC)               3480 (53.81%)
  Logical Lines of Code (LLOC)                    1273 (19.68%)
    Classes                                       1273 (100.00%)
      Average Class Length                          33
        Minimum Class Length                         0
        Maximum Class Length                       129
      Average Method Length                          5
        Minimum Method Length                        1
        Maximum Method Length                       74
      Average Methods Per Class                      6
        Minimum Methods Per Class                    0
        Maximum Methods Per Class                   18
    Functions                                        0 (0.00%)
      Average Function Length                        0
    Not in classes or functions                      0 (0.00%)

Cyclomatic Complexity
  Average Complexity per LLOC                     0.41
  Average Complexity per Class                   14.68
    Minimum Class Complexity                      1.00
    Maximum Class Complexity                     63.00
  Average Complexity per Method                   3.37
    Minimum Method Complexity                     1.00
    Maximum Method Complexity                    40.00

Dependencies
  Global Accesses                                    0
    Global Constants                                 0 (0.00%)
    Global Variables                                 0 (0.00%)
    Super-Global Variables                           0 (0.00%)
  Attribute Accesses                               256
    Non-Static                                     210 (82.03%)
    Static                                          46 (17.97%)
  Method Calls                                     494
    Non-Static                                     314 (63.56%)
    Static                                         180 (36.44%)

Structure
  Namespaces                                         8
  Interfaces                                         5
  Traits                                             1
  Classes                                           32
    Abstract Classes                                 4 (12.50%)
    Concrete Classes                                28 (87.50%)
      Final Classes                                  0 (0.00%)
      Non-Final Classes                             28 (100.00%)
  Methods                                          229
    Scope
      Non-Static Methods                           197 (86.03%)
      Static Methods                                32 (13.97%)
    Visibility
      Public Methods                               191 (83.41%)
      Protected Methods                             32 (13.97%)
      Private Methods                                6 (2.62%)
  Functions                                          6
    Named Functions                                  0 (0.00%)
    Anonymous Functions                              6 (100.00%)
  Constants                                         38
    Global Constants                                 0 (0.00%)
    Class Constants                                 38 (100.00%)
      Public Constants                              38 (100.00%)
      Non-Public Constants                           0 (0.00%)

sop/jwx

https://packagist.org/packages/sop/jwx

最新バージョン: 0.11.1 2021-09-27 06:57 UTC

php: >=7.2

JWS: ○ JWE: ○ JWK: ○

コメント

https://github.com/sop/jwx/issues/2 に脆弱性があるという報告があるが、脆弱性の内容と修正済みかどうかは公表されていませんでした。その後、0.12.0 で修正されました。

サンプルコード
JWS HS256
// compose claims set
$claims = new Claims(
    new IssuerClaim('John Doe'),
    new SubjectClaim('Jane Doe'),
    new AudienceClaim('acme-client'),
    IssuedAtClaim::now(),
    NotBeforeClaim::now(),
    ExpirationTimeClaim::fromString('now + 30 minutes'),
    new JWTIDClaim(UUIDv4::createRandom()->canonical()),
    new Claim('custom claim', ['any', 'values']));
// create a signed JWT using HS256 with "secret" as a password
$jwt = JWT::signedFromClaims($claims, new HS256Algorithm('secret'));
echo $jwt->token() . "\n";

// read JWT token from the first argument
$jwt = new JWT($argv[1]);
// key to use for signature validation
$jwk = SymmetricKeyJWK::fromKey('secret');
// create validation context
$ctx = ValidationContext::fromJWK($jwk)
    ->withIssuer('John Doe')
    ->withSubject('Jane Doe')
    ->withAudience('acme-client');
// get claims set from the JWT. signature shall be verified and claims
// validated according to validation context.
$claims = $jwt->claims($ctx);
// print all claims
foreach ($claims as $claim) {
    printf("%s: %s\n", $claim->name(), json_encode($claim->value()));
}
JWE
// compose claims set
$claims = new Claims(
    new Claim('secret data', 'for your eyes only'),
    IssuedAtClaim::now(),
    NotBeforeClaim::now(),
    ExpirationTimeClaim::fromString('now + 30 minutes'));
// load RSA public key
$jwk = RSAPublicKeyJWK::fromPEM(
    PEM::fromFile(dirname(__DIR__) . '/test/assets/rsa/public_key.pem'));
$key_algo = RSAESPKCS1Algorithm::fromPublicKey($jwk);
$enc_algo = new A128CBCHS256Algorithm();
// create an encrypted JWT token
$jwt = JWT::encryptedFromClaims($claims, $key_algo, $enc_algo);
echo $jwt->token() . "\n";

// read JWT token from the first argument
$jwt = new JWT($argv[1]);
// load RSA private key
$jwk = RSAPrivateKeyJWK::fromPEM(
    PEM::fromFile(dirname(__DIR__) . '/test/assets/rsa/private_key.pem'));
// create validation context containing only key for decryption
$ctx = ValidationContext::fromJWK($jwk)
    // NOTE: asymmetric key derivation algorithms are not enabled by default
    // due to sign/encrypt confusion vulnerability!
    ->withPermittedAlgorithmsAdded(JWA::ALGO_RSA1_5);
// decrypt claims from the encrypted JWT
$claims = $jwt->claims($ctx);
// print all claims
foreach ($claims as $claim) {
    printf("%s: %s\n", $claim->name(), json_encode($claim->value()));
}
ソースサイズ
$ phploc lib
phploc 7.0.2 by Sebastian Bergmann.

Directories                                         24
Files                                              145

Size
  Lines of Code (LOC)                            10643
  Comment Lines of Code (CLOC)                    4253 (39.96%)
  Non-Comment Lines of Code (NCLOC)               6390 (60.04%)
  Logical Lines of Code (LLOC)                    1387 (13.03%)
    Classes                                       1387 (100.00%)
      Average Class Length                           9
        Minimum Class Length                         0
        Maximum Class Length                        71
      Average Method Length                          1
        Minimum Method Length                        1
        Maximum Method Length                       10
      Average Methods Per Class                      4
        Minimum Methods Per Class                    0
        Maximum Methods Per Class                   49
    Functions                                        0 (0.00%)
      Average Function Length                        0
    Not in classes or functions                      0 (0.00%)

Cyclomatic Complexity
  Average Complexity per LLOC                     0.19
  Average Complexity per Class                    2.84
    Minimum Class Complexity                      1.00
    Maximum Class Complexity                     32.00
  Average Complexity per Method                   1.46
    Minimum Method Complexity                     1.00
    Maximum Method Complexity                     9.00

Dependencies
  Global Accesses                                    0
    Global Constants                                 0 (0.00%)
    Global Variables                                 0 (0.00%)
    Super-Global Variables                           0 (0.00%)
  Attribute Accesses                               229
    Non-Static                                     229 (100.00%)
    Static                                           0 (0.00%)
  Method Calls                                     846
    Non-Static                                     552 (65.25%)
    Static                                         294 (34.75%)

Structure
  Namespaces                                        25
  Interfaces                                         6
  Traits                                            10
  Classes                                          129
    Abstract Classes                                21 (16.28%)
    Concrete Classes                               108 (83.72%)
      Final Classes                                  0 (0.00%)
      Non-Final Classes                            108 (100.00%)
  Methods                                          617
    Scope
      Non-Static Methods                           519 (84.12%)
      Static Methods                                98 (15.88%)
    Visibility
      Public Methods                               504 (81.69%)
      Protected Methods                             98 (15.88%)
      Private Methods                               15 (2.43%)
  Functions                                          2
    Named Functions                                  0 (0.00%)
    Anonymous Functions                              2 (100.00%)
  Constants                                        201
    Global Constants                                 0 (0.00%)
    Class Constants                                201 (100.00%)
      Public Constants                             201 (100.00%)
      Non-Public Constants                           0 (0.00%)

参考

Date: 2023/04/16

Tags: php, jwt