2

I just begin to explore Laravel's JWT Authorisation, I'd successfully install it on my Laravel 5.1 and authorize it and test via Postman.

Best Practice has come to my mind, I'd saw some post on stackoverflow regarding about JWT best practices, But I'm not sure currently am I doing it correctly my Laravel Application?

1. Refresh Token

Below are my config/jwt.php settings that follow this post's suggestion that on JWT's UX

'ttl' => 10080, //1week
'refresh_ttl' => 60, // 1 hours

2. Middleware

Is this the best way to wrap a simple JWT API middleware to have jwt auth & refresh middleware?

Route::group(['prefix' => 'api'], function()
{
    Route::post('authenticate', 'AuthenticateController@authenticate');

    Route::group(['middleware' => 'jwt.auth', 'jwt.refresh'], function() {
        Route::resource('authenticate', 'AuthenticateController', ['only' => ['index']]);
        Route::get('authenticate/user', 'AuthenticateController@getAuthenticatedUser');
        Route::get('authenticate/logout', 'AuthenticateController@logout');
        //Other api call that modify user's db....
        Route::post('update_address/', 'otherAPIController@update_address');
        Route::post('update_password/', 'otherAPIController@update_password');
        Route::post('insert_other_stuff/', 'otherAPIController@insert_other_stuff');
    });
});

3. Database

The best is not to heavy modify it default users database? below is my database structure

users : 
- id,uuid,name,email,password,remember_token,created_at,updated_at

users_information :
- id,uuid,address,telephone,first_name,last_name,created_at,updated_at

or may be having

users_role :
- id,uuid,role_id,role_group,role_description,created_at,updated_at

is it good to separate user's tables and we query other information as we authorise JWT with the valid_token using user's uuid value?

Community
  • 1
  • 1
Mavichow
  • 1,213
  • 17
  • 41

0 Answers0