PHP JWT Login Storage

Published September 15th, 2023 15 min read

JSON Web Tokens (JWT) have become a popular method for implementing stateless authentication in web applications. With JWT, user login and authentication data can be securely stored on the client side, reducing the server-side storage requirements. In this tutorial, we'll explore how to implement a PHP JWT login storage mechanism for secure user authentication.

What is JWT?

JSON Web Token (JWT) is a compact, URL-safe means of representing claims to be transferred between two parties. The token is typically signed using a secret or a public/private key pair. JWT is commonly used to authenticate users and share information securely between the client and server.

Step 1: Set Up PHP Environment

Ensure you have PHP installed on your system or server. You can use any PHP web server of your choice (e.g., Apache, Nginx, etc.).

Step 2: Install Required Dependencies

For JWT implementation, we'll use the firebase/php-jwt library. You can install it using Composer:

composer require firebase/php-jwt

Step 3: Implement JWT Login Storage

In this example, we'll create a simple login mechanism using JWT for user authentication. You can integrate this into your existing login system.

<?php
require 'vendor/autoload.php';

use Firebase\JWT\JWT;

// Your user authentication logic goes here
function authenticateUser($username, $password)
{
    // Replace this with your actual user validation logic
    $validUser = ($username === 'demo' && $password === 'demo123');
    return $validUser;
}

// Process login request
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    // Retrieve username and password from the login form
    $username = $_POST['username'];
    $password = $_POST['password'];

    if (authenticateUser($username, $password)) {
        // Generate JWT token
        $secretKey = 'your-secret-key'; // Replace with your own secret key
        $payload = [
            'username' => $username,
            'exp' => time() + (60 * 60), // Token expiration time (1 hour in this example)
        ];
        $token = JWT::encode($payload, $secretKey);

        // Set JWT token in a cookie or local storage for client-side storage
        setcookie('jwt_token', $token, time() + (60 * 60), '/', '', false, true); // Secure HttpOnly cookie

        // Redirect the user to the dashboard or home page
        header('Location: dashboard.php');
        exit;
    } else {
        // Handle invalid credentials or show error message
        echo "Invalid username or password.";
    }
}
?>

<!DOCTYPE html>
<html>
<head>
    <title>JWT Login Storage Example</title>
</head>
<body>
    <h1>Login</h1>
    <form method="post">
        <input type="text" name="username" placeholder="Username" required><br>
        <input type="password" name="password" placeholder="Password" required><br>
        <button type="submit">Login</button>
    </form>
</body>
</html>

Step 4: Protect Authenticated Routes

Now that you have implemented JWT-based authentication, you can protect certain routes by checking the validity of the JWT token.

<?php
require 'vendor/autoload.php';

use Firebase\JWT\JWT;

// Your secret key
$secretKey = 'your-secret-key';

// Check if JWT token exists in the cookie or local storage
if (isset($_COOKIE['jwt_token'])) {
    $token = $_COOKIE['jwt_token'];

    try {
        // Verify and decode the JWT token
        $decodedToken = JWT::decode($token, $secretKey, array('HS256'));

        // Token is valid, do further processing
        $username = $decodedToken->username;
        echo "Welcome, $username!";
    } catch (Exception $e) {
        // Invalid token, redirect to login page or handle unauthorized access
        header('Location: login.php');
        exit;
    }
} else {
    // Token not found, redirect to login page or handle unauthorized access
    header('Location: login.php');
    exit;
}
?>

Conclusion

By implementing a PHP JWT login storage mechanism, you can securely store user authentication data on the client side, making your web application stateless and reducing server-side storage requirements. JSON Web Tokens provide a robust and secure way to handle user authentication in modern web applications. However, it is crucial to handle tokens carefully and ensure proper token expiration and validation to maintain security. Always keep your secret key secret, and use HTTPS for all requests to ensure secure communication between the client and server. Happy coding!