如何使用Composer和web-token/jwt-encryption-algorithm-aesgcm增强JWT内容加密安全性

composer require web-token/jwt-encryption-algorithm-aesgcm

<?php

use Jose\Component\Core\AlgorithmManager;
use Jose\Component\Core\JWK;
use Jose\Component\Encryption\Algorithm\ContentEncryption\A256GCM; // 我们的主角
use Jose\Component\Encryption\Algorithm\KeyEncryption\Dir; // 示例：直接加密密钥
use Jose\Component\Encryption\JWEBuilder;
use Jose\Component\Encryption\JWEDecrypter;
use Jose\Component\Encryption\Serializer\CompactSerializer;

// 1. 准备一个对称加密密钥 (用于AES GCM)
// 在实际应用中，这个密钥应该安全地生成和存储
$sharedSecret = JWK::create([
    'kty' => 'oct',
    'k'   => base64_encode(random_bytes(32)), // 256位密钥
]);

// 2. 构建 JWE 加密器
$keyEncryptionAlgorithmManager = new AlgorithmManager([
    new Dir(), // 直接加密，适用于共享密钥
]);
$contentEncryptionAlgorithmManager = new AlgorithmManager([
    new A256GCM(), // 使用AES-256 GCM进行内容加密
]);

$jweBuilder = new JWEBuilder(
    $keyEncryptionAlgorithmManager,
    $contentEncryptionAlgorithmManager
);

// 3. 定义 JWE 头信息和载荷
$header = [
    'alg' => 'dir',   // 密钥加密算法：直接加密
    'enc' => 'A256GCM', // 内容加密算法：AES-256 GCM
    'cty' => 'JWT',   // 内容类型：JWT
];
$payload = json_encode([
    'userId' => 123,
    'role'   => 'admin',
    'secretData' => '这是只有授权方才能看到的敏感信息',
]);

// 4. 加密 JWT
$jwe = $jweBuilder
    ->withPayload($payload)
    ->withSharedProtectedHeader($header)
    ->addRecipient($sharedSecret) // 添加接收者密钥
    ->build();

$serializer = new CompactSerializer();
$encryptedJwt = $serializer->serialize($jwe);

echo "加密后的JWT:\n" . $encryptedJwt . "\n\n";

// --- 在接收方进行解密 ---

// 1. 构建 JWE 解密器
$jweDecrypter = new JWEDecrypter(
    $keyEncryptionAlgorithmManager,
    $contentEncryptionAlgorithmManager
);

// 2. 解密 JWT
try {
    $loadedJwe = $serializer->unserialize($encryptedJwt);
    $decrypted = $jweDecrypter->decrypt($loadedJwe, $sharedSecret); // 使用相同的密钥解密

    echo "解密后的载荷:\n" . $decrypted->getPayload() . "\n";
    // 输出：{"userId":123,"role":"admin","secretData":"这是只有授权方才能看到的敏感信息"}

} catch (\Exception $e) {
    echo "解密失败: " . $e->getMessage() . "\n";
}