kenken999/php
0
1<?php2 3/*4 * This file is part of jwt-auth.5 *6 * (c) Sean Tymon <tymon148@gmail.com>7 *8 * For the full copyright and license information, please view the LICENSE9 * file that was distributed with this source code.10 */11 12return [13 14 /*15 |--------------------------------------------------------------------------16 | JWT Authentication Secret17 |--------------------------------------------------------------------------18 |19 | Don't forget to set this in your .env file, as it will be used to sign20 | your tokens. A helper command is provided for this:21 | `php artisan jwt:secret`22 |23 | Note: This will be used for Symmetric algorithms only (HMAC),24 | since RSA and ECDSA use a private/public key combo (See below).25 |26 */27 28 'secret' => env('JWT_SECRET'),29 30 /*31 |--------------------------------------------------------------------------32 | JWT Authentication Keys33 |--------------------------------------------------------------------------34 |35 | The algorithm you are using, will determine whether your tokens are36 | signed with a random string (defined in `JWT_SECRET`) or using the37 | following public & private keys.38 |39 | Symmetric Algorithms:40 | HS256, HS384 & HS512 will use `JWT_SECRET`.41 |42 | Asymmetric Algorithms:43 | RS256, RS384 & RS512 / ES256, ES384 & ES512 will use the keys below.44 |45 */46 47 'keys' => [48 49 /*50 |--------------------------------------------------------------------------51 | Public Key52 |--------------------------------------------------------------------------53 |54 | A path or resource to your public key.55 |56 | E.g. 'file://path/to/public/key'57 |58 */59 60 'public' => env('JWT_PUBLIC_KEY'),61 62 /*63 |--------------------------------------------------------------------------64 | Private Key65 |--------------------------------------------------------------------------66 |67 | A path or resource to your private key.68 |69 | E.g. 'file://path/to/private/key'70 |71 */72 73 'private' => env('JWT_PRIVATE_KEY'),74 75 /*76 |--------------------------------------------------------------------------77 | Passphrase78 |--------------------------------------------------------------------------79 |80 | The passphrase for your private key. Can be null if none set.81 |82 */83 84 'passphrase' => env('JWT_PASSPHRASE'),85 86 ],87 88 /*89 |--------------------------------------------------------------------------90 | JWT time to live91 |--------------------------------------------------------------------------92 |93 | Specify the length of time (in minutes) that the token will be valid for.94 | Defaults to 1 hour.95 |96 | You can also set this to null, to yield a never expiring token.97 | Some people may want this behaviour for e.g. a mobile app.98 | This is not particularly recommended, so make sure you have appropriate99 | systems in place to revoke the token if necessary.100 | Notice: If you set this to null you should remove 'exp' element from 'required_claims' list.101 |102 */103 104 'ttl' => env('JWT_TTL', 6000),105 106 /*107 |--------------------------------------------------------------------------108 | Refresh time to live109 |--------------------------------------------------------------------------110 |111 | Specify the length of time (in minutes) that the token can be refreshed112 | within. I.E. The user can refresh their token within a 2 week window of113 | the original token being created until they must re-authenticate.114 | Defaults to 2 weeks.115 |116 | You can also set this to null, to yield an infinite refresh time.117 | Some may want this instead of never expiring tokens for e.g. a mobile app.118 | This is not particularly recommended, so make sure you have appropriate119 | systems in place to revoke the token if necessary.120 |121 */122 123 'refresh_ttl' => env('JWT_REFRESH_TTL', 20160),124 125 /*126 |--------------------------------------------------------------------------127 | JWT hashing algorithm128 |--------------------------------------------------------------------------129 |130 | Specify the hashing algorithm that will be used to sign the token.131 |132 | See here: https://github.com/namshi/jose/tree/master/src/Namshi/JOSE/Signer/OpenSSL133 | for possible values.134 |135 */136 137 'algo' => env('JWT_ALGO', 'HS256'),138 139 /*140 |--------------------------------------------------------------------------141 | Required Claims142 |--------------------------------------------------------------------------143 |144 | Specify the required claims that must exist in any token.145 | A TokenInvalidException will be thrown if any of these claims are not146 | present in the payload.147 |148 */149 150 'required_claims' => [151 'iss',152 'iat',153 'exp',154 'nbf',155 'sub',156 'jti',157 ],158 159 /*160 |--------------------------------------------------------------------------161 | Persistent Claims162 |--------------------------------------------------------------------------163 |164 | Specify the claim keys to be persisted when refreshing a token.165 | `sub` and `iat` will automatically be persisted, in166 | addition to the these claims.167 |168 | Note: If a claim does not exist then it will be ignored.169 |170 */171 172 'persistent_claims' => [173 // 'foo',174 // 'bar',175 ],176 177 /*178 |--------------------------------------------------------------------------179 | Lock Subject180 |--------------------------------------------------------------------------181 |182 | This will determine whether a `prv` claim is automatically added to183 | the token. The purpose of this is to ensure that if you have multiple184 | authentication models e.g. `App\User` & `App\OtherPerson`, then we185 | should prevent one authentication request from impersonating another,186 | if 2 tokens happen to have the same id across the 2 different models.187 |188 | Under specific circumstances, you may want to disable this behaviour189 | e.g. if you only have one authentication model, then you would save190 | a little on token size.191 |192 */193 194 'lock_subject' => true,195 196 /*197 |--------------------------------------------------------------------------198 | Leeway199 |--------------------------------------------------------------------------200 |201 | This property gives the jwt timestamp claims some "leeway".202 | Meaning that if you have any unavoidable slight clock skew on203 | any of your servers then this will afford you some level of cushioning.204 |205 | This applies to the claims `iat`, `nbf` and `exp`.206 |207 | Specify in seconds - only if you know you need it.208 |209 */210 211 'leeway' => env('JWT_LEEWAY', 0),212 213 /*214 |--------------------------------------------------------------------------215 | Blacklist Enabled216 |--------------------------------------------------------------------------217 |218 | In order to invalidate tokens, you must have the blacklist enabled.219 | If you do not want or need this functionality, then set this to false.220 |221 */222 223 'blacklist_enabled' => env('JWT_BLACKLIST_ENABLED', true),224 225 /*226 | -------------------------------------------------------------------------227 | Blacklist Grace Period228 | -------------------------------------------------------------------------229 |230 | When multiple concurrent requests are made with the same JWT,231 | it is possible that some of them fail, due to token regeneration232 | on every request.233 |234 | Set grace period in seconds to prevent parallel request failure.235 |236 */237 238 'blacklist_grace_period' => env('JWT_BLACKLIST_GRACE_PERIOD', 0),239 240 /*241 |--------------------------------------------------------------------------242 | Cookies encryption243 |--------------------------------------------------------------------------244 |245 | By default Laravel encrypt cookies for security reason.246 | If you decide to not decrypt cookies, you will have to configure Laravel247 | to not encrypt your cookie token by adding its name into the $except248 | array available in the middleware "EncryptCookies" provided by Laravel.249 | see https://laravel.com/docs/master/responses#cookies-and-encryption250 | for details.251 |252 | Set it to true if you want to decrypt cookies.253 |254 */255 256 'decrypt_cookies' => false,257 258 /*259 |--------------------------------------------------------------------------260 | Providers261 |--------------------------------------------------------------------------262 |263 | Specify the various providers used throughout the package.264 |265 */266 267 'providers' => [268 269 /*270 |--------------------------------------------------------------------------271 | JWT Provider272 |--------------------------------------------------------------------------273 |274 | Specify the provider that is used to create and decode the tokens.275 |276 */277 278 'jwt' => Tymon\JWTAuth\Providers\JWT\Lcobucci::class,279 280 /*281 |--------------------------------------------------------------------------282 | Authentication Provider283 |--------------------------------------------------------------------------284 |285 | Specify the provider that is used to authenticate users.286 |287 */288 289 'auth' => Tymon\JWTAuth\Providers\Auth\Illuminate::class,290 291 /*292 |--------------------------------------------------------------------------293 | Storage Provider294 |--------------------------------------------------------------------------295 |296 | Specify the provider that is used to store tokens in the blacklist.297 |298 */299 300 'storage' => Tymon\JWTAuth\Providers\Storage\Illuminate::class,301 302 ],303 304];305