How to generate JWT in PHP

Question

How to generate JWT token in php using with the following parameters Subject, Issuer, Expiry time and payload in the < PAYLOAD > tag.

Id can be any random number of any length.
subject is TestService
Issuer is Baguma Inc
Expiry Time will be 30 sec from current time(ideally ).
Payload is the request from Third Party
SigningKEY is fcvxcnfrhrtghkfghgwerikdf
Signature algorithm will be HS512.

Sample request from Third Party is shown below

<COMMAND><TYPE>REQUEST</TYPE><INTERFACE>TESTACCOUNT</INTERFACE> <REQUESTID>123</REQUESTID></COMMAND

Welcome to Stack Overflow. Please show what you have tried so far. — Connell.O'Donnell, Jan 18 '21 at 22:15
@Connell.O'Donnell I finally got the solution. I have shared it in the answer section. Hope it will be helpful to other developers — Baguma, Apr 08 '21 at 06:28

score 8 · Answer 1 · answered Aug 07 '22 at 23:49

8

Your answer got me started. Here's the working code I went with (albeit generalized from your specific case). Thanks for getting me started!

function gen_jwt():String{
    $signing_key = "changeme";
    $header = [ 
        "alg" => "HS512", 
        "typ" => "JWT" 
    ];
    $header = base64_url_encode(json_encode($header));
    $payload =  [
        "exp" => 0,
    ];
    $payload = base64_url_encode(json_encode($payload));
    $signature = base64_url_encode(hash_hmac('sha512', "$header.$payload", $signing_key, true));
    $jwt = "$header.$payload.$signature";
    return $jwt;    
}

/**
 * per https://stackoverflow.com/questions/2040240/php-function-to-generate-v4-uuid/15875555#15875555
 */
function base64_url_encode($text):String{
    return str_replace(['+', '/', '='], ['-', '_', ''], base64_encode($text));
}

answered Aug 07 '22 at 23:49

cloudsurfin

2,467
2
25
29

2

No need for extra external libraries. Thanks a lot! JWT validates fine @ https://jwt.io/ – Cagy79 Sep 08 '22 at 20:22
Another Tip: For my target API I needed to change the algo & hmac to HS256 + sha256 to avoid an "Algorithm not allowed" error. – Cagy79 Sep 08 '22 at 20:39
For decoding use `function base64_url_decode($text) { return base64_decode(str_replace(['-', '_'], ['+', '/'], $text)); } ` – Jurakin Jun 19 '23 at 06:48

score 2 · Accepted Answer · edited May 06 '23 at 08:24

With the help of an article from DZone Security, I managed to generate a JWT token by doing the following

Define the base64UrlEncode function which replaces + with -, / with _ and = with ''.

function base64UrlEncode($text)
{
    return str_replace(
        ['+', '/', '='],
        ['-', '_', ''],
        base64_encode($text)
    );
}

Encode the headers using base64UrlEncode

$headers = [ "alg" => "HS512"];

$headers_encoded = $this->base64UrlEncode(json_encode($headers));

Encode the Payload using Base64 URL encode as well

$issuedAt = time();

    $payload =  [
        "id" =>$this->gen_uuid(), //   .setId(UUID.randomUUID().toString())
        "sub"=> "TestService", //Subject
        "exp"=> $issuedAt+30,
        "iss"=> "Baguma Inc",  //issuer
        "iat"=> $issuedAt,  //issued at
        "PAYLOAD"=> "<COMMAND><TYPE>REQUEST</TYPE><INTERFACE>TESTACCOUNT</INTERFACE> <REQUESTID>123</REQUESTID></COMMAND"];

      $payload_encoded = $this->base64UrlEncode(json_encode($payload));

Using the Key/secret build the signature

$key = "fcvxcnfrhrtghkfghgwerikdf";  
$signature = hash_hmac('sha512',"$headers_encoded.$payload_encoded",$key,true);

5 Encode the signature

$signature_encoded = $this->base64UrlEncode($signature);

Build and return the token

$token = "$headers_encoded.$payload_encoded.$signature_encoded";

@AbhiBeckert thanks for that observation. Update has been done. — Baguma, May 01 '23 at 08:36
The last parameter "true" (binary) in hash_mac function can lead to generate multiple line in header and to break your http response. I put it to false and it worked well for me with symfony rest controller. — mik3fly-4steri5k, May 07 '23 at 10:45
@mik3fly-4steri5k if you're using php the parameter true is needed. Please refer to official/ verified libraries via https://jwt.io/libraries. But thanks for your feedback — Baguma, May 08 '23 at 11:07

score 0 · Answer 3 · answered Mar 17 '23 at 13:06

0

You can use the PHP Library like Firebase JWT https://github.com/firebase/php-jwt

answered Mar 17 '23 at 13:06

Vysakh Vijayakumar

59
3

How to generate JWT in PHP

3 Answers3