php-jwt
Halite
Our great sponsors
| php-jwt | Halite | |
|---|---|---|
| 16 | 7 | |
| 9,222 | 1,111 | |
| 0.7% | 0.0% | |
| 5.8 | 0.0 | |
| about 1 month ago | almost 2 years ago | |
| PHP | PHP | |
| BSD 3-clause "New" or "Revised" License | Mozilla Public License 2.0 |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
php-jwt
- firebase/php-jwt: PHP package for JWT
-
Understanding user authentication on web and API
So basically if the login is successfull I have to create a JWT token (with something like this library) with the userID inside and send it via `setcookie()` for web or in a JSON response to the API client and consider it the long lived refresh token.
-
What is the best way to implement in-app purchases without a third-party service?
This depends on the library you end up downloading for the platform of your choosing. Some of the parts I explained above will be handled by the library for example in my case I decoded signedTransactionInfo using firebase/php-jwt. This has the added benefit of always checking the validity of the signature which was omitted in the manual method.
- Why there's not a native way to work with JWT in Laravel?
-
How can I decode the header from the JWT?
https://github.com/firebase/php-jwt i use this one, its really good
- ElastiCache for Redis as session handler for ECS container...
- Weekly "ask anything" thread
-
API Tokens: A Tedious Survey
> Why all the hate for JWTs?
> Just pick a crypto scheme and the JWT is just an encoding that makes it easier to use.
That's not what JWT is, but I can understand why someone would be misled into believing that.
JWT isn't just an encoding format, it also includes a crypto algorithm negotiation protocol that lets the attacker choose the algorithm. Even if you strictly allow-list which algorithm you want to support, you can accidentally bypass this control in many libraries if you suppor the `kid` (key ID) header. [1]
It also allows attackers to completely strip the security. [2] [3]
Put shortly, JWT is a gun aimed directly at your foot. That's why there's so much hate for JWTs.
[1] https://github.com/firebase/php-jwt/issues/351
[2] https://paragonie.com/blog/2017/03/jwt-json-web-tokens-is-ba...
[3] https://www.howmanydayssinceajwtalgnonevuln.com/
- Firebase/PHP-JWT: New Risk of HS256/RSA256 Algorithm Confusion
- Possible security issue involving the Firebase JWT library for PHP (Algorithm Confusion with Key IDs)
Halite
- sodium_crypto_secretbox
-
Does Halite do PGP?
I'm trying to find a PHP package that will handle PGP encryption/decryption. Halite keeps coming up but I can't tell from searching if it handles PGP. If it doesn't, can you recommend a PHP package that does? Thanks!
-
Sodium encryption and digital signing made simple
Sounds like https://github.com/paragonie/halite. What does this do better?
- Halite (usable cryptography library for PHP) version 5.0.0 released (Security Improvements within!)
-
Weekly "ask anything" thread
One of the Golden Rules of Computing is "Never roll your own Crypto" (without a PhD in Cryptography). If you need to encrypt something at rest I'd recommend the really very excellent Halite Library.
-
PASETO v2.0.0 released! (Lengthy release notes)
10,000%. I love Halite.
-
PHP.Net Documentation for ext/sodium Coming Soon
Excellent job! I've been using the https://github.com/paragonie/halite library on top of Sodium just so I don't have to re-work everything out, but this is going to be nice for cases when including third party libraries isn't possible!
What are some alternatives?
PHP OAuth 2.0 Server - A spec compliant, secure by default PHP OAuth 2.0 Server
PHP Encryption - Simple Encryption in PHP.
Ratchet - Asynchronous WebSocket server
PHPSecLib - PHP Secure Communications Library
Fast Route - Fast request router for PHP
HTML Purifier - Standards compliant HTML filter written in PHP
fusionauth-jwt - A simple to use Java 8 JWT Library. Verify, Sign, Encode, Decode all day.
PHP IDS - PHPIDS (PHP-Intrusion Detection System) is a simple to use, well structured, fast and state-of-the-art security layer for your PHP based web application
paseto - Platform-Agnostic Security Tokens
PHP SSH - An experimental object oriented SSH api in PHP
bubble - bubble 旨在为项目快速开发提供一系列的基础能力，方便使用者根据项目需求快速进行功能拓展。已将所有 JAR 包都推送至中央仓库，也会为每个版本的升级改动列出详细的更新日志
random_compat - PHP 5.x support for random_bytes() and random_int()