简体繁体 English

使用JWT的Laravel API身份验证

[英]Laravel API Authentication with JWT

原文 2016-02-08 18:29:10 2 2 php/ api/ authentication/ jwt

I'm reading the book: Build APIs You Won't Hate , and it propose several Authentication methods: 我正在读这本书：构建您不会讨厌的API ，它提出了几种身份验证方法：

Basic Auth 基本认证
Digest Authentication 摘要式身份验证
OAuth 1.0a OAuth 1.0a
OAuth 2.0 OAuth 2.0
OpenID OpenID的
Hawk 鹰
Oz 奥兹

I have a application that will have differents components 我有一个具有不同组件的应用程序

Internal APIs 内部API
Laravel WebApp with FB / Google Login via Socialite Laravel WebApp带有FB /通过Socialite登录
VueJs VueJs
Mobile App 移动应用

I will not have a public API. 我将没有公共API。

I was thinking of using JWT to secure my APIs, but as I don't see it in the book, I'm wondering if I am not making a mistake. 我当时在考虑使用JWT来保护我的API，但是由于我在书中没有看到它，所以我想知道自己是否犯错了。

Any advice will be apreciated! 任何建议将不胜感激！

2 个解决方案

Using JWT is a good practice for securing APIs it is not a mistake as far as I'm concerned. 使用JWT是保护API的好习惯，就我而言，这并不是一个错误。

But as Laravel 5.3 is now released and we have a Laravel Passport (OAuth2 Server) for API authentication which would be very help full to you I think. 但是随着Laravel 5.3的发布，我们有了一个用于API身份验证的Laravel Passport（OAuth2服务器），这对您来说非常有帮助。

You could refer the Laravel 5.3 release note for the document. 您可以参考Laravel 5.3发行说明。 Also Laracast has a free video tutorial explained in detail. 另外，Laracast还提供了详细解释的免费视频教程。

I have achieved JWT auth on Laravel 5.2 using the jwt-auth Laravel package by Sean Tymon, https://github.com/tymondesigns/jwt-auth 我已经使用Sean Tymon的jwt-auth Laravel包在Laravel 5.2上实现了JWT身份验证， https://github.com/tymondesigns/jwt-auth

If you are interested in an example that uses vue.js for the UI, I have written a post to document my findings, http://jimfrenette.com/2016/11/laravel-vuejs2-jwt-auth/ and have posted the source code on github, https://github.com/jimfrenette/laravel-vuejs-jwt-auth 如果您对使用vue.js作为UI的示例感兴趣，我已经写了一篇文章记录我的发现， http： //jimfrenette.com/2016/11/laravel-vuejs2-jwt-auth/，并发布了github上的源代码， https://github.com/jimfrenette/laravel-vuejs-jwt-auth