eutkin/nette-jwt

Nette IUserStorage implementation using JWT instead of sessions.

nette-jwt-user-storage

, _(*1)

, _(*2)

Nette IUserStorage implementation using JWT access token instead of PHP sessions., _(*3)

Disclaimer: If you don't know what JWT is, please refer to JWT draft or to JWT homepage., _(*4)

On user login, the application stores jwt_access_token cookie instead of bad old PHPSESSID one. The cookie contains an encoded JWT signed by the application. The user authentication is then based on verifying the JWT rather than the session., _(*5)

Warning: CSRF protection rules still apply!, _(*6)

This means you no longer need to solve PHP session implementation, scaling and testing problems. All the things that you would normally store in the SessionStorage can be stored in a key-value storage, where the JWT is a key., _(*7)

This also means your application is ready to become SPA in the future. :), _(*8)

Configuration

Register the extension in your config.neon., _(*9)

extensions:
    jwtUserStorage: Klimesf\Security\DI\JWTUserStorageExtension

Then configure its required properties., _(*10)

JWTUserStorage:
    privateKey: 'secret-cat'    # this secret is used to sign the JWT
    algorithm: 'HS256'          # this is the signing algorithm

Both the JWT and the cookie in which it's stored is by default set to expire in 20 days. If you want to fiddle with expiration time, use expiration option:, _(*11)

JWTUserStorage:
    expiration: 20 days     # sets JWT and cookie expiration time to 20 days (this is the default option)
    expiration: 20 minutes  # sets JWT and cookie expiration time to 20 minutes
    expiration: false       # sets JWT and cookie to never expire

By default, jti and iat (see JWT draft) are added to your JWTs. If you don't want to use them, set generateJti and generateIat options to false., _(*12)

JWTUserStorage:
    generateJti: false          # disables jti generation for your JWT access tokens
    generateIat: false          # disables iat generation for your JWT access tokens

If you want to define your own Nette\Security\IIdentity serializer, which serializes your identity implementation into the JWT body, you can implement Klimesf\Security\IIdentitySerializer, _(*13)

namespace Your\Own;

class IdentitySerializer implements \Klimesf\Security\IIdentitySerializer
{
    // ...
}

and register it in configuration., _(*14)

JWTUserStorage:
    identitySerializer: Your\Own\IdentitySerializer

And that's it, you're ready to go!, _(*15)

Known issues

• If you are developing an app with JWT User Storage and you still see PHPSESSID in your cookies, it's probably because Tracy\Tracy uses it.

Discussion threads

• Czech discussion thread on Nette Forum

Literature

• Stormpath: Where to store JWTs
• Reddit: JWT vs session cookies
• Dev Kimchi
• JTI Generation