PHP中如何安全地实现API认证与数据加密？SimpleJWT与Composer助你轻松搞定

<code class="bash">composer require kelvinmo/simplejwt</code>

<code class="php">require 'vendor/autoload.php';</code>

<pre class="brush:php;toolbar:false;">use SimpleJWT\Keys\KeySet;
use SimpleJWT\Keys\SymmetricKey;
use SimpleJWT\Keys\RSAKey;

// 方式一：从秘密字符串创建（适用于HMAC）
$keySet = KeySet::createFromSecret('your_super_secret_key_here_at_least_32_chars');

// 方式二：从JWK Set JSON文件加载
// $keySet = new KeySet();
// $keySet->load(file_get_contents('path/to/your/jwk_set.json'));

// 方式三：手动添加PEM格式的RSA密钥
// $keySet = new KeySet();
// $rsaPrivateKey = new RSAKey(file_get_contents('path/to/your/private_key.pem'), 'pem');
// $keySet->add($rsaPrivateKey);

<pre class="brush:php;toolbar:false;">use SimpleJWT\JWT;

$headers = ['alg' => 'HS256', 'typ' => 'JWT']; // 使用HS256算法
$claims = [
    'iss' => 'your_app_name', // 签发者
    'sub' => 'user_id_123',   // 主题
    'exp' => time() + 3600,   // 过期时间（1小时后）
    'name' => 'John Doe',
    'admin' => true
];

$jwt = new JWT($headers, $claims);

try {
    $token = $jwt->encode($keySet); // 使用之前创建的密钥集进行签名并编码
    echo "生成的JWT: " . $token . "\n";
} catch (\RuntimeException $e) {
    echo "JWT编码失败: " . $e->getMessage() . "\n";
}

<pre class="brush:php;toolbar:false;">use SimpleJWT\JWT;
use SimpleJWT\InvalidTokenException;

$receivedToken = $token; // 假设这是从客户端接收到的JWT

try {
    // 解码并验证JWT。第二个参数是密钥集，第三个参数是期望的算法
    $decodedJwt = JWT::decode($receivedToken, $keySet, 'HS256');

    echo "JWT验证成功！\n";
    echo "用户ID: " . $decodedJwt->getClaim('sub') . "\n";
    echo "用户名: " . $decodedJwt->getClaim('name') . "\n";
    echo "是否管理员: " . ($decodedJwt->getClaim('admin') ? '是' : '否') . "\n";
    echo "过期时间: " . date('Y-m-d H:i:s', $decodedJwt->getClaim('exp')) . "\n";

} catch (InvalidTokenException $e) {
    echo "JWT验证失败: " . $e->getMessage() . "\n";
} catch (\RuntimeException $e) {
    echo "JWT处理异常: " . $e->getMessage() . "\n";
}

<pre class="brush:php;toolbar:false;">use SimpleJWT\JWE;

// JWE头部，需要指定密钥管理算法（alg）和内容加密算法（enc）
$jweHeaders = ['alg' => 'A128KW', 'enc' => 'A128CBC-HS256'];
$plaintext = 'This is a very secret message that needs to be encrypted.';

$jwe = new JWE($jweHeaders, $plaintext);

try {
    $encryptedToken = $jwe->encrypt($keySet);
    echo "加密后的JWE: " . $encryptedToken . "\n";
} catch (\RuntimeException $e) {
    echo "JWE加密失败: " . $e->getMessage() . "\n";
}

// 解密JWE
try {
    $decryptedJwe = JWE::decrypt($encryptedToken, $keySet, 'A128KW');
    echo "解密后的明文: " . $decryptedJwe->getPlaintext() . "\n";
} catch (InvalidTokenException $e) {
    echo "JWE解密失败: " . $e->getMessage() . "\n";
}