YII框架的JWT支持是什么？YII框架如何使用JWT认证？

HttpBearerAuth

IdentityInterface

firebase/php-jwt

composer require firebase/php-jwt

IdentityInterface

app\models\User

findIdentityByAccessToken()

$token

// app/models/User.php (示例片段)
use Firebase\JWT\JWT;
use Firebase\JWT\Key;
use yii\web\IdentityInterface;

class User extends ActiveRecord implements IdentityInterface
{
    // ...其他IdentityInterface方法实现...

    /**
     * Finds an identity by the given token.
     * @param string $token the token to be looked for
     * @param mixed $type the type of the token (e.g. "access token", "refresh token")
     * @return IdentityInterface|null the identity object that matches the given token.
     */
    public static function findIdentityByAccessToken($token, $type = null)
    {
        $secretKey = 'your-super-secret-key'; // 务必替换成强随机密钥，并妥善保管
        try {
            // 解析并验证JWT
            $decoded = JWT::decode($token, new Key($secretKey, 'HS256'));

            // 检查JWT中的用户ID是否有效，并返回对应的用户实例
            if (isset($decoded->uid)) {
                return static::findOne(['id' => $decoded->uid]);
            }
        } catch (\Exception $e) {
            // JWT无效或过期，这里可以记录日志
            Yii::error("JWT validation failed: " . $e->getMessage());
            return null;
        }
        return null;
    }
}

config/web.php

user

// config/web.php (示例片段)
return [
    'components' => [
        'user' => [
            'identityClass' => 'app\models\User',
            'enableAutoLogin' => false, // API通常不需要自动登录
            'enableSession' => false,   // API通常不需要session
        ],
        // ... 其他组件 ...
    ],
    'as beforeRequest' => [ // 全局应用行为，处理所有请求的认证
        'class' => 'yii\filters\Cors', // 跨域处理，如果需要
        // ...
    ],
    // ...
];

HttpBearerAuth

Authorization: Bearer <token>

User::findIdentityByAccessToken()

// app/controllers/ApiController.php (示例片段)
use yii\rest\ActiveController;
use yii\filters\auth\HttpBearerAuth;

class ApiController extends ActiveController
{
    public $modelClass = 'app\models\SomeModel'; // 你的API资源模型

    public function behaviors()
    {
        $behaviors = parent::behaviors();
        $behaviors['authenticator'] = [
            'class' => HttpBearerAuth::class,
            'except' => ['login', 'signup'], // 登录和注册接口通常不需要认证
        ];
        return $behaviors;
    }

    // ... 你的API动作 ...
    public function actionLogin()
    {
        // 验证用户凭据（用户名/密码）
        // 如果验证成功，生成JWT并返回给客户端
        $user = User::findByUsername(Yii::$app->request->post('username'));
        if ($user && $user->validatePassword(Yii::$app->request->post('password'))) {
            $secretKey = 'your-super-secret-key';
            $issuedAt = time();
            $expirationTime = $issuedAt + 3600; // 1小时过期

            $payload = [
                'iat' => $issuedAt,
                'exp' => $expirationTime,
                'uid' => $user->id,
                // 'aud' => 'your-app-audience', // 接收方
                // 'iss' => 'your-issuer', // 签发者
            ];

            $jwt = JWT::encode($payload, $secretKey, 'HS256');
            return ['access_token' => $jwt, 'expires_in' => $expirationTime];
        }

        throw new \yii\web\UnauthorizedHttpException('Invalid credentials.');
    }
}

Authorization: Bearer <你的JWT>

Authorization

Bearer

HttpBearerAuth

user

findIdentityByAccessToken()

user

your-super-secret-key

jti

exp

findIdentityByAccessToken

exp

// app/controllers/AuthController.php (示例片段)
// ...
class AuthController extends Controller
{
    // ...
    public function actionRefresh()
    {
        $refreshToken = Yii::$app->request->post('refresh_token');

        // 1. 验证refresh_token的有效性
        // 假设你有一个RefreshTokens模型来管理它们
        $dbRefreshToken = RefreshToken::findOne(['token' => $refreshToken, 'user_id' => Yii::$app->user->id]);

        if (!$dbRefreshToken || $dbRefreshToken->isExpired()) {
            throw new \yii\web\UnauthorizedHttpException('Invalid or expired refresh token.');
        }

        // 2. 废弃旧的refresh_token（可选，但推荐）
        $dbRefreshToken->delete(); // 或标记为已使用

        // 3. 生成新的access token
        $secretKey = 'your-super-secret-key';
        $issuedAt = time();
        $expirationTime = $issuedAt + 3600; // 新的access token 1小时过期

        $payload = [
            'iat' => $issuedAt,
            'exp' => $expirationTime,
            'uid' => Yii::$app->user->id,
        ];
        $newAccessToken = JWT::encode($payload, $secretKey, 'HS256');

        // 4. 生成新的refresh token（如果需要）
        $newRefreshToken = Yii::$app->security->generateRandomString(64);
        $newRefreshTokenModel = new RefreshToken();
        $newRefreshTokenModel->token = $newRefreshToken;
        $newRefreshTokenModel->user_id = Yii::$app->user->id;
        $newRefreshTokenModel->expires_at = time() + (30 * 24 * 3600); // 30天过期
        $newRefreshTokenModel->save();

        return [
            'access_token' => $newAccessToken,
            'expires_in' => $expirationTime,
            'refresh_token' => $newRefreshToken,
        ];
    }
}

findIdentityByAccessToken

// app/models/User.php (findIdentityByAccessToken 方法内)
// ...
if (isset($decoded->jti)) { // JWT ID
    // 检查这个jti是否在黑名单中
    if (BlacklistedToken::isBlacklisted($decoded->jti)) {
        Yii::warning("Attempt to use blacklisted JWT: " . $decoded->jti);
        return null;
    }
}
// ...

jti