Enabled Json Web Token authorisation on backend, and frontend
This commit is contained in:
Nedim Uka
@@ -0,0 +1,339 @@
|
||||
GNU GENERAL PUBLIC LICENSE
|
||||
Version 2, June 1991
|
||||
|
||||
Copyright (C) 1989, 1991 Free Software Foundation, Inc.,
|
||||
51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
|
||||
Everyone is permitted to copy and distribute verbatim copies
|
||||
of this license document, but changing it is not allowed.
|
||||
|
||||
Preamble
|
||||
|
||||
The licenses for most software are designed to take away your
|
||||
freedom to share and change it. By contrast, the GNU General Public
|
||||
License is intended to guarantee your freedom to share and change free
|
||||
software--to make sure the software is free for all its users. This
|
||||
General Public License applies to most of the Free Software
|
||||
Foundation's software and to any other program whose authors commit to
|
||||
using it. (Some other Free Software Foundation software is covered by
|
||||
the GNU Lesser General Public License instead.) You can apply it to
|
||||
your programs, too.
|
||||
|
||||
When we speak of free software, we are referring to freedom, not
|
||||
price. Our General Public Licenses are designed to make sure that you
|
||||
have the freedom to distribute copies of free software (and charge for
|
||||
this service if you wish), that you receive source code or can get it
|
||||
if you want it, that you can change the software or use pieces of it
|
||||
in new free programs; and that you know you can do these things.
|
||||
|
||||
To protect your rights, we need to make restrictions that forbid
|
||||
anyone to deny you these rights or to ask you to surrender the rights.
|
||||
These restrictions translate to certain responsibilities for you if you
|
||||
distribute copies of the software, or if you modify it.
|
||||
|
||||
For example, if you distribute copies of such a program, whether
|
||||
gratis or for a fee, you must give the recipients all the rights that
|
||||
you have. You must make sure that they, too, receive or can get the
|
||||
source code. And you must show them these terms so they know their
|
||||
rights.
|
||||
|
||||
We protect your rights with two steps: (1) copyright the software, and
|
||||
(2) offer you this license which gives you legal permission to copy,
|
||||
distribute and/or modify the software.
|
||||
|
||||
Also, for each author's protection and ours, we want to make certain
|
||||
that everyone understands that there is no warranty for this free
|
||||
software. If the software is modified by someone else and passed on, we
|
||||
want its recipients to know that what they have is not the original, so
|
||||
that any problems introduced by others will not reflect on the original
|
||||
authors' reputations.
|
||||
|
||||
Finally, any free program is threatened constantly by software
|
||||
patents. We wish to avoid the danger that redistributors of a free
|
||||
program will individually obtain patent licenses, in effect making the
|
||||
program proprietary. To prevent this, we have made it clear that any
|
||||
patent must be licensed for everyone's free use or not licensed at all.
|
||||
|
||||
The precise terms and conditions for copying, distribution and
|
||||
modification follow.
|
||||
|
||||
GNU GENERAL PUBLIC LICENSE
|
||||
TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
|
||||
|
||||
0. This License applies to any program or other work which contains
|
||||
a notice placed by the copyright holder saying it may be distributed
|
||||
under the terms of this General Public License. The "Program", below,
|
||||
refers to any such program or work, and a "work based on the Program"
|
||||
means either the Program or any derivative work under copyright law:
|
||||
that is to say, a work containing the Program or a portion of it,
|
||||
either verbatim or with modifications and/or translated into another
|
||||
language. (Hereinafter, translation is included without limitation in
|
||||
the term "modification".) Each licensee is addressed as "you".
|
||||
|
||||
Activities other than copying, distribution and modification are not
|
||||
covered by this License; they are outside its scope. The act of
|
||||
running the Program is not restricted, and the output from the Program
|
||||
is covered only if its contents constitute a work based on the
|
||||
Program (independent of having been made by running the Program).
|
||||
Whether that is true depends on what the Program does.
|
||||
|
||||
1. You may copy and distribute verbatim copies of the Program's
|
||||
source code as you receive it, in any medium, provided that you
|
||||
conspicuously and appropriately publish on each copy an appropriate
|
||||
copyright notice and disclaimer of warranty; keep intact all the
|
||||
notices that refer to this License and to the absence of any warranty;
|
||||
and give any other recipients of the Program a copy of this License
|
||||
along with the Program.
|
||||
|
||||
You may charge a fee for the physical act of transferring a copy, and
|
||||
you may at your option offer warranty protection in exchange for a fee.
|
||||
|
||||
2. You may modify your copy or copies of the Program or any portion
|
||||
of it, thus forming a work based on the Program, and copy and
|
||||
distribute such modifications or work under the terms of Section 1
|
||||
above, provided that you also meet all of these conditions:
|
||||
|
||||
a) You must cause the modified files to carry prominent notices
|
||||
stating that you changed the files and the date of any change.
|
||||
|
||||
b) You must cause any work that you distribute or publish, that in
|
||||
whole or in part contains or is derived from the Program or any
|
||||
part thereof, to be licensed as a whole at no charge to all third
|
||||
parties under the terms of this License.
|
||||
|
||||
c) If the modified program normally reads commands interactively
|
||||
when run, you must cause it, when started running for such
|
||||
interactive use in the most ordinary way, to print or display an
|
||||
announcement including an appropriate copyright notice and a
|
||||
notice that there is no warranty (or else, saying that you provide
|
||||
a warranty) and that users may redistribute the program under
|
||||
these conditions, and telling the user how to view a copy of this
|
||||
License. (Exception: if the Program itself is interactive but
|
||||
does not normally print such an announcement, your work based on
|
||||
the Program is not required to print an announcement.)
|
||||
|
||||
These requirements apply to the modified work as a whole. If
|
||||
identifiable sections of that work are not derived from the Program,
|
||||
and can be reasonably considered independent and separate works in
|
||||
themselves, then this License, and its terms, do not apply to those
|
||||
sections when you distribute them as separate works. But when you
|
||||
distribute the same sections as part of a whole which is a work based
|
||||
on the Program, the distribution of the whole must be on the terms of
|
||||
this License, whose permissions for other licensees extend to the
|
||||
entire whole, and thus to each and every part regardless of who wrote it.
|
||||
|
||||
Thus, it is not the intent of this section to claim rights or contest
|
||||
your rights to work written entirely by you; rather, the intent is to
|
||||
exercise the right to control the distribution of derivative or
|
||||
collective works based on the Program.
|
||||
|
||||
In addition, mere aggregation of another work not based on the Program
|
||||
with the Program (or with a work based on the Program) on a volume of
|
||||
a storage or distribution medium does not bring the other work under
|
||||
the scope of this License.
|
||||
|
||||
3. You may copy and distribute the Program (or a work based on it,
|
||||
under Section 2) in object code or executable form under the terms of
|
||||
Sections 1 and 2 above provided that you also do one of the following:
|
||||
|
||||
a) Accompany it with the complete corresponding machine-readable
|
||||
source code, which must be distributed under the terms of Sections
|
||||
1 and 2 above on a medium customarily used for software interchange; or,
|
||||
|
||||
b) Accompany it with a written offer, valid for at least three
|
||||
years, to give any third party, for a charge no more than your
|
||||
cost of physically performing source distribution, a complete
|
||||
machine-readable copy of the corresponding source code, to be
|
||||
distributed under the terms of Sections 1 and 2 above on a medium
|
||||
customarily used for software interchange; or,
|
||||
|
||||
c) Accompany it with the information you received as to the offer
|
||||
to distribute corresponding source code. (This alternative is
|
||||
allowed only for noncommercial distribution and only if you
|
||||
received the program in object code or executable form with such
|
||||
an offer, in accord with Subsection b above.)
|
||||
|
||||
The source code for a work means the preferred form of the work for
|
||||
making modifications to it. For an executable work, complete source
|
||||
code means all the source code for all modules it contains, plus any
|
||||
associated interface definition files, plus the scripts used to
|
||||
control compilation and installation of the executable. However, as a
|
||||
special exception, the source code distributed need not include
|
||||
anything that is normally distributed (in either source or binary
|
||||
form) with the major components (compiler, kernel, and so on) of the
|
||||
operating system on which the executable runs, unless that component
|
||||
itself accompanies the executable.
|
||||
|
||||
If distribution of executable or object code is made by offering
|
||||
access to copy from a designated place, then offering equivalent
|
||||
access to copy the source code from the same place counts as
|
||||
distribution of the source code, even though third parties are not
|
||||
compelled to copy the source along with the object code.
|
||||
|
||||
4. You may not copy, modify, sublicense, or distribute the Program
|
||||
except as expressly provided under this License. Any attempt
|
||||
otherwise to copy, modify, sublicense or distribute the Program is
|
||||
void, and will automatically terminate your rights under this License.
|
||||
However, parties who have received copies, or rights, from you under
|
||||
this License will not have their licenses terminated so long as such
|
||||
parties remain in full compliance.
|
||||
|
||||
5. You are not required to accept this License, since you have not
|
||||
signed it. However, nothing else grants you permission to modify or
|
||||
distribute the Program or its derivative works. These actions are
|
||||
prohibited by law if you do not accept this License. Therefore, by
|
||||
modifying or distributing the Program (or any work based on the
|
||||
Program), you indicate your acceptance of this License to do so, and
|
||||
all its terms and conditions for copying, distributing or modifying
|
||||
the Program or works based on it.
|
||||
|
||||
6. Each time you redistribute the Program (or any work based on the
|
||||
Program), the recipient automatically receives a license from the
|
||||
original licensor to copy, distribute or modify the Program subject to
|
||||
these terms and conditions. You may not impose any further
|
||||
restrictions on the recipients' exercise of the rights granted herein.
|
||||
You are not responsible for enforcing compliance by third parties to
|
||||
this License.
|
||||
|
||||
7. If, as a consequence of a court judgment or allegation of patent
|
||||
infringement or for any other reason (not limited to patent issues),
|
||||
conditions are imposed on you (whether by court order, agreement or
|
||||
otherwise) that contradict the conditions of this License, they do not
|
||||
excuse you from the conditions of this License. If you cannot
|
||||
distribute so as to satisfy simultaneously your obligations under this
|
||||
License and any other pertinent obligations, then as a consequence you
|
||||
may not distribute the Program at all. For example, if a patent
|
||||
license would not permit royalty-free redistribution of the Program by
|
||||
all those who receive copies directly or indirectly through you, then
|
||||
the only way you could satisfy both it and this License would be to
|
||||
refrain entirely from distribution of the Program.
|
||||
|
||||
If any portion of this section is held invalid or unenforceable under
|
||||
any particular circumstance, the balance of the section is intended to
|
||||
apply and the section as a whole is intended to apply in other
|
||||
circumstances.
|
||||
|
||||
It is not the purpose of this section to induce you to infringe any
|
||||
patents or other property right claims or to contest validity of any
|
||||
such claims; this section has the sole purpose of protecting the
|
||||
integrity of the free software distribution system, which is
|
||||
implemented by public license practices. Many people have made
|
||||
generous contributions to the wide range of software distributed
|
||||
through that system in reliance on consistent application of that
|
||||
system; it is up to the author/donor to decide if he or she is willing
|
||||
to distribute software through any other system and a licensee cannot
|
||||
impose that choice.
|
||||
|
||||
This section is intended to make thoroughly clear what is believed to
|
||||
be a consequence of the rest of this License.
|
||||
|
||||
8. If the distribution and/or use of the Program is restricted in
|
||||
certain countries either by patents or by copyrighted interfaces, the
|
||||
original copyright holder who places the Program under this License
|
||||
may add an explicit geographical distribution limitation excluding
|
||||
those countries, so that distribution is permitted only in or among
|
||||
countries not thus excluded. In such case, this License incorporates
|
||||
the limitation as if written in the body of this License.
|
||||
|
||||
9. The Free Software Foundation may publish revised and/or new versions
|
||||
of the General Public License from time to time. Such new versions will
|
||||
be similar in spirit to the present version, but may differ in detail to
|
||||
address new problems or concerns.
|
||||
|
||||
Each version is given a distinguishing version number. If the Program
|
||||
specifies a version number of this License which applies to it and "any
|
||||
later version", you have the option of following the terms and conditions
|
||||
either of that version or of any later version published by the Free
|
||||
Software Foundation. If the Program does not specify a version number of
|
||||
this License, you may choose any version ever published by the Free Software
|
||||
Foundation.
|
||||
|
||||
10. If you wish to incorporate parts of the Program into other free
|
||||
programs whose distribution conditions are different, write to the author
|
||||
to ask for permission. For software which is copyrighted by the Free
|
||||
Software Foundation, write to the Free Software Foundation; we sometimes
|
||||
make exceptions for this. Our decision will be guided by the two goals
|
||||
of preserving the free status of all derivatives of our free software and
|
||||
of promoting the sharing and reuse of software generally.
|
||||
|
||||
NO WARRANTY
|
||||
|
||||
11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
|
||||
FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN
|
||||
OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
|
||||
PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
|
||||
OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
|
||||
MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS
|
||||
TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE
|
||||
PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING,
|
||||
REPAIR OR CORRECTION.
|
||||
|
||||
12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
|
||||
WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
|
||||
REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
|
||||
INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING
|
||||
OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED
|
||||
TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY
|
||||
YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
|
||||
PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
|
||||
POSSIBILITY OF SUCH DAMAGES.
|
||||
|
||||
END OF TERMS AND CONDITIONS
|
||||
|
||||
How to Apply These Terms to Your New Programs
|
||||
|
||||
If you develop a new program, and you want it to be of the greatest
|
||||
possible use to the public, the best way to achieve this is to make it
|
||||
free software which everyone can redistribute and change under these terms.
|
||||
|
||||
To do so, attach the following notices to the program. It is safest
|
||||
to attach them to the start of each source file to most effectively
|
||||
convey the exclusion of warranty; and each file should have at least
|
||||
the "copyright" line and a pointer to where the full notice is found.
|
||||
|
||||
<one line to give the program's name and a brief idea of what it does.>
|
||||
Copyright (C) <year> <name of author>
|
||||
|
||||
This program is free software; you can redistribute it and/or modify
|
||||
it under the terms of the GNU General Public License as published by
|
||||
the Free Software Foundation; either version 2 of the License, or
|
||||
(at your option) any later version.
|
||||
|
||||
This program is distributed in the hope that it will be useful,
|
||||
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
GNU General Public License for more details.
|
||||
|
||||
You should have received a copy of the GNU General Public License along
|
||||
with this program; if not, write to the Free Software Foundation, Inc.,
|
||||
51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
|
||||
Also add information on how to contact you by electronic and paper mail.
|
||||
|
||||
If the program is interactive, make it output a short notice like this
|
||||
when it starts in an interactive mode:
|
||||
|
||||
Gnomovision version 69, Copyright (C) year name of author
|
||||
Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
|
||||
This is free software, and you are welcome to redistribute it
|
||||
under certain conditions; type `show c' for details.
|
||||
|
||||
The hypothetical commands `show w' and `show c' should show the appropriate
|
||||
parts of the General Public License. Of course, the commands you use may
|
||||
be called something other than `show w' and `show c'; they could even be
|
||||
mouse-clicks or menu items--whatever suits your program.
|
||||
|
||||
You should also get your employer (if you work as a programmer) or your
|
||||
school, if any, to sign a "copyright disclaimer" for the program, if
|
||||
necessary. Here is a sample; alter the names:
|
||||
|
||||
Yoyodyne, Inc., hereby disclaims all copyright interest in the program
|
||||
`Gnomovision' (which makes passes at compilers) written by James Hacker.
|
||||
|
||||
<signature of Ty Coon>, 1 April 1989
|
||||
Ty Coon, President of Vice
|
||||
|
||||
This General Public License does not permit incorporating your program into
|
||||
proprietary programs. If your program is a subroutine library, you may
|
||||
consider it more useful to permit linking proprietary applications with the
|
||||
library. If this is what you want to do, use the GNU Lesser General
|
||||
Public License instead of this License.
|
||||
@@ -0,0 +1,343 @@
|
||||
# JWT Authentication for the WP REST API
|
||||
|
||||
A simple plugin to add [JSON Web Token (JWT)](https://tools.ietf.org/html/rfc7519) Authentication to the WP REST API.
|
||||
|
||||
To know more about JSON Web Tokens, please visit [http://jwt.io](http://jwt.io).
|
||||
|
||||
## Requirements
|
||||
|
||||
### WP REST API V2
|
||||
|
||||
This plugin was conceived to extend the [WP REST API V2](https://github.com/WP-API/WP-API) plugin features and, of course, was built on top of it.
|
||||
|
||||
So, to use the **wp-api-jwt-auth** you need to install and activate [WP REST API](https://github.com/WP-API/WP-API).
|
||||
|
||||
### PHP
|
||||
|
||||
**Minimum PHP version: 5.3.0**
|
||||
|
||||
### Eable PHP HTTP Authorization Header
|
||||
|
||||
#### Shared Hosts
|
||||
|
||||
Most of the shared hosts have disabled the **HTTP Authorization Header** by default.
|
||||
|
||||
To enable this option you'll need to edit your **.htaccess** file by adding the following:
|
||||
|
||||
```
|
||||
RewriteEngine on
|
||||
RewriteCond %{HTTP:Authorization} ^(.*)
|
||||
RewriteRule ^(.*) - [E=HTTP_AUTHORIZATION:%1]
|
||||
```
|
||||
|
||||
#### WPEngine
|
||||
|
||||
To enable this option you'll need to edit your **.htaccess** file by adding the following (see https://github.com/Tmeister/wp-api-jwt-auth/issues/1):
|
||||
|
||||
```
|
||||
SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1
|
||||
```
|
||||
|
||||
## Installation & Configuration
|
||||
|
||||
[Download the zip file](https://github.com/Tmeister/wp-api-jwt-auth/archive/master.zip) and install it like any other WordPress plugin.
|
||||
|
||||
Or clone this repo into your WordPress installation into the wp-content/plugins folder.
|
||||
|
||||
### Configurate the Secret Key
|
||||
|
||||
The JWT needs a **secret key** to sign the token. This **secret key** must be unique and never revealed.
|
||||
|
||||
To add the **secret key**, edit your wp-config.php file and add a new constant called **JWT_AUTH_SECRET_KEY**.
|
||||
|
||||
|
||||
```php
|
||||
define('JWT_AUTH_SECRET_KEY', 'your-top-secrect-key');
|
||||
```
|
||||
|
||||
You can use a string from here https://api.wordpress.org/secret-key/1.1/salt/
|
||||
|
||||
### Configurate CORs Support
|
||||
|
||||
The **wp-api-jwt-auth** plugin has the option to activate [CORs](https://en.wikipedia.org/wiki/Cross-origin_resource_sharing) support.
|
||||
|
||||
To enable the CORs Support edit your wp-config.php file and add a new constant called **JWT_AUTH_CORS_ENABLE**
|
||||
|
||||
|
||||
```php
|
||||
define('JWT_AUTH_CORS_ENABLE', true);
|
||||
```
|
||||
|
||||
|
||||
Finally activate the plugin within the plugin dashboard.
|
||||
|
||||
## Namespace and Endpoints
|
||||
|
||||
When the plugin is activated, a new namespace is added.
|
||||
|
||||
|
||||
```
|
||||
/jwt-auth/v1
|
||||
```
|
||||
|
||||
|
||||
Also, two new endpoints are added to this namespace.
|
||||
|
||||
|
||||
Endpoint | HTTP Verb
|
||||
--- | ---
|
||||
*/wp-json/jwt-auth/v1/token* | POST
|
||||
*/wp-json/jwt-auth/v1/token/validate* | POST
|
||||
|
||||
##Usage
|
||||
### /wp-json/jwt-auth/v1/token
|
||||
|
||||
This is the entry point for the JWT Authentication.
|
||||
|
||||
Validates the user credentials, *username* and *password*, and returns a token to use in a future request to the API if the authentication is correct or error if the authentication fails.
|
||||
|
||||
####Sample request using AngularJS
|
||||
|
||||
```javascript
|
||||
|
||||
( function() {
|
||||
var app = angular.module( 'jwtAuth', [] );
|
||||
|
||||
app.controller( 'MainController', function( $scope, $http ) {
|
||||
|
||||
var apiHost = 'http://yourdomain.com/wp-json';
|
||||
|
||||
$http.post( apiHost + '/jwt-auth/v1/token', {
|
||||
username: 'admin',
|
||||
password: 'password'
|
||||
} )
|
||||
|
||||
.then( function( response ) {
|
||||
console.log( response.data )
|
||||
} )
|
||||
|
||||
.catch( function( error ) {
|
||||
console.error( 'Error', error.data[0] );
|
||||
} );
|
||||
|
||||
} );
|
||||
|
||||
} )();
|
||||
|
||||
|
||||
```
|
||||
|
||||
Success response from the server:
|
||||
|
||||
```json
|
||||
{
|
||||
"token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJodHRwOlwvXC9qd3QuZGV2IiwiaWF0IjoxNDM4NTcxMDUwLCJuYmYiOjE0Mzg1NzEwNTAsImV4cCI6MTQzOTE3NTg1MCwiZGF0YSI6eyJ1c2VyIjp7ImlkIjoiMSJ9fX0.YNe6AyWW4B7ZwfFE5wJ0O6qQ8QFcYizimDmBy6hCH_8",
|
||||
"user_display_name": "admin",
|
||||
"user_email": "admin@localhost.dev",
|
||||
"user_nicename": "admin"
|
||||
}
|
||||
```
|
||||
|
||||
Error response from the server:
|
||||
|
||||
```json
|
||||
{
|
||||
"code": "jwt_auth_failed",
|
||||
"data": {
|
||||
"status": 403
|
||||
},
|
||||
"message": "Invalid Credentials."
|
||||
}
|
||||
```
|
||||
|
||||
Once you get the token, you must store it somewhere in your application, e.g. in a **cookie** or using **localstorage**.
|
||||
|
||||
From this point, you should pass this token to every API call.
|
||||
|
||||
Sample call using the Authorization header using AngularJS:
|
||||
|
||||
```javascript
|
||||
app.config( function( $httpProvider ) {
|
||||
$httpProvider.interceptors.push( [ '$q', '$location', '$cookies', function( $q, $location, $cookies ) {
|
||||
return {
|
||||
'request': function( config ) {
|
||||
config.headers = config.headers || {};
|
||||
//Assume that you store the token in a cookie.
|
||||
var globals = $cookies.getObject( 'globals' ) || {};
|
||||
//If the cookie has the CurrentUser and the token
|
||||
//add the Authorization header in each request
|
||||
if ( globals.currentUser && globals.currentUser.token ) {
|
||||
config.headers.Authorization = 'Bearer ' + globals.currentUser.token;
|
||||
}
|
||||
return config;
|
||||
}
|
||||
};
|
||||
} ] );
|
||||
} );
|
||||
```
|
||||
|
||||
The **wp-api-jwt-auth** will intercept every call to the server and will look for the authorization header, if the authorization header is present, it will try to decode the token and will set the user according with the data stored in it.
|
||||
|
||||
If the token is valid, the API call flow will continue as always.
|
||||
|
||||
**Sample Headers**
|
||||
|
||||
```
|
||||
POST /resource HTTP/1.1
|
||||
Host: server.example.com
|
||||
Authorization: Bearer mF_s9.B5f-4.1JqM
|
||||
```
|
||||
|
||||
###Errors
|
||||
|
||||
If the token is invalid an error will be returned. Here are some samples of errors:
|
||||
|
||||
**Invalid Credentials**
|
||||
|
||||
```json
|
||||
[
|
||||
{
|
||||
"code": "jwt_auth_failed",
|
||||
"message": "Invalid Credentials.",
|
||||
"data": {
|
||||
"status": 403
|
||||
}
|
||||
}
|
||||
]
|
||||
```
|
||||
|
||||
**Invalid Signature**
|
||||
|
||||
```json
|
||||
[
|
||||
{
|
||||
"code": "jwt_auth_invalid_token",
|
||||
"message": "Signature verification failed",
|
||||
"data": {
|
||||
"status": 403
|
||||
}
|
||||
}
|
||||
]
|
||||
```
|
||||
|
||||
**Expired Token**
|
||||
|
||||
```json
|
||||
[
|
||||
{
|
||||
"code": "jwt_auth_invalid_token",
|
||||
"message": "Expired token",
|
||||
"data": {
|
||||
"status": 403
|
||||
}
|
||||
}
|
||||
]
|
||||
```
|
||||
|
||||
### /wp-json/jwt-auth/v1/token/validate
|
||||
|
||||
This is a simple helper endpoint to validate a token; you only will need to make a POST request sending the Authorization header.
|
||||
|
||||
Valid Token Response:
|
||||
|
||||
```json
|
||||
{
|
||||
"code": "jwt_auth_valid_token",
|
||||
"data": {
|
||||
"status": 200
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
##Available Hooks
|
||||
|
||||
The **wp-api-jwt-auth** is dev friendly and has five filters available to override the default settings.
|
||||
|
||||
####jwt_auth_cors_allow_headers
|
||||
|
||||
The **jwt_auth_cors_allow_headers** allows you to modify the available headers when the CORs support is enabled.
|
||||
|
||||
Default Value:
|
||||
|
||||
```
|
||||
'Access-Control-Allow-Headers, Content-Type, Authorization'
|
||||
```
|
||||
|
||||
###jwt_auth_not_before
|
||||
|
||||
The **jwt_auth_not_before** allows you to change the [**nbf**](https://tools.ietf.org/html/rfc7519#section-4.1.5) value before the token is created.
|
||||
|
||||
Default Value:
|
||||
|
||||
```
|
||||
Creation time - time()
|
||||
```
|
||||
|
||||
###jwt_auth_expire
|
||||
|
||||
The **jwt_auth_expire** allows you to change the value [**exp**](https://tools.ietf.org/html/rfc7519#section-4.1.4) before the token is created.
|
||||
|
||||
Default Value:
|
||||
|
||||
```
|
||||
time() + (DAY_IN_SECONDS * 7)
|
||||
```
|
||||
|
||||
###jwt_auth_token_before_sign
|
||||
|
||||
The **jwt_auth_token_before_sign** allows you to modify all the token data before to be encoded and signed.
|
||||
|
||||
Default value:
|
||||
|
||||
```php
|
||||
<?php
|
||||
$token = array(
|
||||
'iss' => get_bloginfo('url'),
|
||||
'iat' => $issuedAt,
|
||||
'nbf' => $notBefore,
|
||||
'exp' => $expire,
|
||||
'data' => array(
|
||||
'user' => array(
|
||||
'id' => $user->data->ID,
|
||||
)
|
||||
)
|
||||
);
|
||||
```
|
||||
|
||||
###jwt_auth_token_before_dispatch
|
||||
The **jwt_auth_token_before_dispatch** allows you to modify all the response array before to dispatch it to the client.
|
||||
|
||||
Default value:
|
||||
|
||||
```php
|
||||
<?php
|
||||
$data = array(
|
||||
'token' => $token,
|
||||
'user_email' => $user->data->user_email,
|
||||
'user_nicename' => $user->data->user_nicename,
|
||||
'user_display_name' => $user->data->display_name,
|
||||
);
|
||||
```
|
||||
|
||||
## Testing
|
||||
|
||||
Since version **1.1.0** I've added a new test suite to be sure that the basic features of this plugin do what it's expected.
|
||||
|
||||
You can run this test using the following command
|
||||
|
||||
```
|
||||
composer install
|
||||
includes/vendor/bin/phpunit tests
|
||||
```
|
||||
|
||||
|
||||
|
||||
All the tests can be found at https://github.com/Tmeister/wp-api-jwt-auth/tree/develop/tests/GeneralTest.php
|
||||
|
||||
##Credits
|
||||
[WP REST API V2](http://v2.wp-api.org/)
|
||||
|
||||
[PHP-JWT from firebase](https://github.com/firebase/php-jwt)
|
||||
|
||||
##License
|
||||
[GPLv2](http://www.gnu.org/licenses/old-licenses/gpl-2.0.html)
|
||||
@@ -0,0 +1,12 @@
|
||||
{
|
||||
"config": {
|
||||
"vendor-dir": "includes/vendor"
|
||||
},
|
||||
"require": {
|
||||
"firebase/php-jwt": "^5.0.0"
|
||||
},
|
||||
"require-dev": {
|
||||
"phpunit/phpunit": "^5.2",
|
||||
"guzzlehttp/guzzle": "^6.1"
|
||||
}
|
||||
}
|
||||
1609
backend/wp-content/plugins/jwt-authentication-for-wp-rest-api/composer.lock
generated
Normal file
1609
backend/wp-content/plugins/jwt-authentication-for-wp-rest-api/composer.lock
generated
Normal file
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,59 @@
|
||||
<?php
|
||||
|
||||
/**
|
||||
* Define the internationalization functionality.
|
||||
*
|
||||
* Loads and defines the internationalization files for this plugin
|
||||
* so that it is ready for translation.
|
||||
*
|
||||
* @link https://enriquechavez.co
|
||||
* @since 1.0.0
|
||||
*/
|
||||
|
||||
/**
|
||||
* Define the internationalization functionality.
|
||||
*
|
||||
* Loads and defines the internationalization files for this plugin
|
||||
* so that it is ready for translation.
|
||||
*
|
||||
* @since 1.0.0
|
||||
*
|
||||
* @author Enrique Chavez <noone@tmeister.net>
|
||||
*/
|
||||
class Jwt_Auth_i18n
|
||||
{
|
||||
/**
|
||||
* The domain specified for this plugin.
|
||||
*
|
||||
* @since 1.0.0
|
||||
*
|
||||
* @var string The domain identifier for this plugin.
|
||||
*/
|
||||
private $domain;
|
||||
|
||||
/**
|
||||
* Load the plugin text domain for translation.
|
||||
*
|
||||
* @since 1.0.0
|
||||
*/
|
||||
public function load_plugin_textdomain()
|
||||
{
|
||||
load_plugin_textdomain(
|
||||
$this->domain,
|
||||
false,
|
||||
dirname(dirname(plugin_basename(__FILE__))).'/languages/'
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* Set the domain equal to that of the specified domain.
|
||||
*
|
||||
* @since 1.0.0
|
||||
*
|
||||
* @param string $domain The domain that represents the locale of this plugin.
|
||||
*/
|
||||
public function set_domain($domain)
|
||||
{
|
||||
$this->domain = $domain;
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,125 @@
|
||||
<?php
|
||||
|
||||
/**
|
||||
* Register all actions and filters for the plugin.
|
||||
*
|
||||
* @link https://enriquechavez.co
|
||||
* @since 1.0.0
|
||||
*/
|
||||
|
||||
/**
|
||||
* Register all actions and filters for the plugin.
|
||||
*
|
||||
* Maintain a list of all hooks that are registered throughout
|
||||
* the plugin, and register them with the WordPress API. Call the
|
||||
* run function to execute the list of actions and filters.
|
||||
*
|
||||
* @author Enrique Chavez <noone@tmeister.net>
|
||||
*/
|
||||
class Jwt_Auth_Loader
|
||||
{
|
||||
/**
|
||||
* The array of actions registered with WordPress.
|
||||
*
|
||||
* @since 1.0.0
|
||||
*
|
||||
* @var array The actions registered with WordPress to fire when the plugin loads.
|
||||
*/
|
||||
protected $actions;
|
||||
|
||||
/**
|
||||
* The array of filters registered with WordPress.
|
||||
*
|
||||
* @since 1.0.0
|
||||
*
|
||||
* @var array The filters registered with WordPress to fire when the plugin loads.
|
||||
*/
|
||||
protected $filters;
|
||||
|
||||
/**
|
||||
* Initialize the collections used to maintain the actions and filters.
|
||||
*
|
||||
* @since 1.0.0
|
||||
*/
|
||||
public function __construct()
|
||||
{
|
||||
$this->actions = array();
|
||||
$this->filters = array();
|
||||
}
|
||||
|
||||
/**
|
||||
* Add a new action to the collection to be registered with WordPress.
|
||||
*
|
||||
* @since 1.0.0
|
||||
*
|
||||
* @param string $hook The name of the WordPress action that is being registered.
|
||||
* @param object $component A reference to the instance of the object on which the action is defined.
|
||||
* @param string $callback The name of the function definition on the $component.
|
||||
* @param int Optional $priority The priority at which the function should be fired.
|
||||
* @param int Optional $accepted_args The number of arguments that should be passed to the $callback.
|
||||
*/
|
||||
public function add_action($hook, $component, $callback, $priority = 10, $accepted_args = 1)
|
||||
{
|
||||
$this->actions = $this->add($this->actions, $hook, $component, $callback, $priority, $accepted_args);
|
||||
}
|
||||
|
||||
/**
|
||||
* Add a new filter to the collection to be registered with WordPress.
|
||||
*
|
||||
* @since 1.0.0
|
||||
*
|
||||
* @param string $hook The name of the WordPress filter that is being registered.
|
||||
* @param object $component A reference to the instance of the object on which the filter is defined.
|
||||
* @param string $callback The name of the function definition on the $component.
|
||||
* @param int Optional $priority The priority at which the function should be fired.
|
||||
* @param int Optional $accepted_args The number of arguments that should be passed to the $callback.
|
||||
*/
|
||||
public function add_filter($hook, $component, $callback, $priority = 10, $accepted_args = 1)
|
||||
{
|
||||
$this->filters = $this->add($this->filters, $hook, $component, $callback, $priority, $accepted_args);
|
||||
}
|
||||
|
||||
/**
|
||||
* A utility function that is used to register the actions and hooks into a single
|
||||
* collection.
|
||||
*
|
||||
* @since 1.0.0
|
||||
*
|
||||
* @param array $hooks The collection of hooks that is being registered (that is, actions or filters).
|
||||
* @param string $hook The name of the WordPress filter that is being registered.
|
||||
* @param object $component A reference to the instance of the object on which the filter is defined.
|
||||
* @param string $callback The name of the function definition on the $component.
|
||||
* @param int Optional $priority The priority at which the function should be fired.
|
||||
* @param int Optional $accepted_args The number of arguments that should be passed to the $callback.
|
||||
*
|
||||
* @return type The collection of actions and filters registered with WordPress.
|
||||
*/
|
||||
private function add($hooks, $hook, $component, $callback, $priority, $accepted_args)
|
||||
{
|
||||
$hooks[] = array(
|
||||
'hook' => $hook,
|
||||
'component' => $component,
|
||||
'callback' => $callback,
|
||||
'priority' => $priority,
|
||||
'accepted_args' => $accepted_args,
|
||||
);
|
||||
|
||||
return $hooks;
|
||||
}
|
||||
|
||||
/**
|
||||
* Register the filters and actions with WordPress.
|
||||
*
|
||||
* @since 1.0.0
|
||||
*/
|
||||
public function run()
|
||||
{
|
||||
foreach ($this->filters as $hook) {
|
||||
add_filter($hook['hook'], array($hook['component'], $hook['callback']), $hook['priority'], $hook['accepted_args']);
|
||||
}
|
||||
|
||||
foreach ($this->actions as $hook) {
|
||||
add_action($hook['hook'], array($hook['component'], $hook['callback']), $hook['priority'], $hook['accepted_args']);
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,194 @@
|
||||
<?php
|
||||
|
||||
/**
|
||||
* The file that defines the core plugin class.
|
||||
*
|
||||
* A class definition that includes attributes and functions used across both the
|
||||
* public-facing side of the site and the admin area.
|
||||
*
|
||||
* @link https://enriquechavez.co
|
||||
* @since 1.0.0
|
||||
*/
|
||||
|
||||
/**
|
||||
* The core plugin class.
|
||||
*
|
||||
* This is used to define internationalization, admin-specific hooks, and
|
||||
* public-facing site hooks.
|
||||
*
|
||||
* Also maintains the unique identifier of this plugin as well as the current
|
||||
* version of the plugin.
|
||||
*
|
||||
* @since 1.0.0
|
||||
*
|
||||
* @author Enrique Chavez <noone@tmeister.net>
|
||||
*/
|
||||
class Jwt_Auth
|
||||
{
|
||||
/**
|
||||
* The loader that's responsible for maintaining and registering all hooks that power
|
||||
* the plugin.
|
||||
*
|
||||
* @since 1.0.0
|
||||
*
|
||||
* @var Jwt_Auth_Loader Maintains and registers all hooks for the plugin.
|
||||
*/
|
||||
protected $loader;
|
||||
|
||||
/**
|
||||
* The unique identifier of this plugin.
|
||||
*
|
||||
* @since 1.0.0
|
||||
*
|
||||
* @var string The string used to uniquely identify this plugin.
|
||||
*/
|
||||
protected $plugin_name;
|
||||
|
||||
/**
|
||||
* The current version of the plugin.
|
||||
*
|
||||
* @since 1.0.0
|
||||
*
|
||||
* @var string The current version of the plugin.
|
||||
*/
|
||||
protected $version;
|
||||
|
||||
/**
|
||||
* Define the core functionality of the plugin.
|
||||
*
|
||||
* Set the plugin name and the plugin version that can be used throughout the plugin.
|
||||
* Load the dependencies, define the locale, and set the hooks for the admin area and
|
||||
* the public-facing side of the site.
|
||||
*
|
||||
* @since 1.0.0
|
||||
*/
|
||||
public function __construct()
|
||||
{
|
||||
$this->plugin_name = 'jwt-auth';
|
||||
$this->version = '1.1.0';
|
||||
|
||||
$this->load_dependencies();
|
||||
$this->set_locale();
|
||||
$this->define_public_hooks();
|
||||
}
|
||||
|
||||
/**
|
||||
* Load the required dependencies for this plugin.
|
||||
*
|
||||
* Include the following files that make up the plugin:
|
||||
*
|
||||
* - Jwt_Auth_Loader. Orchestrates the hooks of the plugin.
|
||||
* - Jwt_Auth_i18n. Defines internationalization functionality.
|
||||
* - Jwt_Auth_Admin. Defines all hooks for the admin area.
|
||||
* - Jwt_Auth_Public. Defines all hooks for the public side of the site.
|
||||
*
|
||||
* Create an instance of the loader which will be used to register the hooks
|
||||
* with WordPress.
|
||||
*
|
||||
* @since 1.0.0
|
||||
*/
|
||||
private function load_dependencies()
|
||||
{
|
||||
|
||||
/**
|
||||
* Load dependecies managed by composer.
|
||||
*/
|
||||
require_once plugin_dir_path(dirname(__FILE__)).'includes/vendor/autoload.php';
|
||||
|
||||
/**
|
||||
* The class responsible for orchestrating the actions and filters of the
|
||||
* core plugin.
|
||||
*/
|
||||
require_once plugin_dir_path(dirname(__FILE__)).'includes/class-jwt-auth-loader.php';
|
||||
|
||||
/**
|
||||
* The class responsible for defining internationalization functionality
|
||||
* of the plugin.
|
||||
*/
|
||||
require_once plugin_dir_path(dirname(__FILE__)).'includes/class-jwt-auth-i18n.php';
|
||||
|
||||
/**
|
||||
* The class responsible for defining all actions that occur in the public-facing
|
||||
* side of the site.
|
||||
*/
|
||||
require_once plugin_dir_path(dirname(__FILE__)).'public/class-jwt-auth-public.php';
|
||||
|
||||
$this->loader = new Jwt_Auth_Loader();
|
||||
}
|
||||
|
||||
/**
|
||||
* Define the locale for this plugin for internationalization.
|
||||
*
|
||||
* Uses the Jwt_Auth_i18n class in order to set the domain and to register the hook
|
||||
* with WordPress.
|
||||
*
|
||||
* @since 1.0.0
|
||||
*/
|
||||
private function set_locale()
|
||||
{
|
||||
$plugin_i18n = new Jwt_Auth_i18n();
|
||||
$plugin_i18n->set_domain($this->get_plugin_name());
|
||||
$this->loader->add_action('plugins_loaded', $plugin_i18n, 'load_plugin_textdomain');
|
||||
}
|
||||
/**
|
||||
* Register all of the hooks related to the public-facing functionality
|
||||
* of the plugin.
|
||||
*
|
||||
* @since 1.0.0
|
||||
*/
|
||||
private function define_public_hooks()
|
||||
{
|
||||
$plugin_public = new Jwt_Auth_Public($this->get_plugin_name(), $this->get_version());
|
||||
$this->loader->add_action('rest_api_init', $plugin_public, 'add_api_routes');
|
||||
$this->loader->add_filter('rest_api_init', $plugin_public, 'add_cors_support');
|
||||
$this->loader->add_filter('determine_current_user', $plugin_public, 'determine_current_user', 10);
|
||||
$this->loader->add_filter( 'rest_pre_dispatch', $plugin_public, 'rest_pre_dispatch', 10, 2 );
|
||||
}
|
||||
|
||||
/**
|
||||
* Run the loader to execute all of the hooks with WordPress.
|
||||
*
|
||||
* @since 1.0.0
|
||||
*/
|
||||
public function run()
|
||||
{
|
||||
$this->loader->run();
|
||||
}
|
||||
|
||||
/**
|
||||
* The name of the plugin used to uniquely identify it within the context of
|
||||
* WordPress and to define internationalization functionality.
|
||||
*
|
||||
* @since 1.0.0
|
||||
*
|
||||
* @return string The name of the plugin.
|
||||
*/
|
||||
public function get_plugin_name()
|
||||
{
|
||||
return $this->plugin_name;
|
||||
}
|
||||
|
||||
/**
|
||||
* The reference to the class that orchestrates the hooks with the plugin.
|
||||
*
|
||||
* @since 1.0.0
|
||||
*
|
||||
* @return Jwt_Auth_Loader Orchestrates the hooks of the plugin.
|
||||
*/
|
||||
public function get_loader()
|
||||
{
|
||||
return $this->loader;
|
||||
}
|
||||
|
||||
/**
|
||||
* Retrieve the version number of the plugin.
|
||||
*
|
||||
* @since 1.0.0
|
||||
*
|
||||
* @return string The version number of the plugin.
|
||||
*/
|
||||
public function get_version()
|
||||
{
|
||||
return $this->version;
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1 @@
|
||||
<?php // Silence is golden
|
||||
7
backend/wp-content/plugins/jwt-authentication-for-wp-rest-api/includes/vendor/autoload.php
vendored
Normal file
7
backend/wp-content/plugins/jwt-authentication-for-wp-rest-api/includes/vendor/autoload.php
vendored
Normal file
@@ -0,0 +1,7 @@
|
||||
<?php
|
||||
|
||||
// autoload.php @generated by Composer
|
||||
|
||||
require_once __DIR__ . '/composer/autoload_real.php';
|
||||
|
||||
return ComposerAutoloaderInit6ba6ee55693d165c056f65e51c5383a5::getLoader();
|
||||
@@ -0,0 +1,445 @@
|
||||
<?php
|
||||
|
||||
/*
|
||||
* This file is part of Composer.
|
||||
*
|
||||
* (c) Nils Adermann <naderman@naderman.de>
|
||||
* Jordi Boggiano <j.boggiano@seld.be>
|
||||
*
|
||||
* For the full copyright and license information, please view the LICENSE
|
||||
* file that was distributed with this source code.
|
||||
*/
|
||||
|
||||
namespace Composer\Autoload;
|
||||
|
||||
/**
|
||||
* ClassLoader implements a PSR-0, PSR-4 and classmap class loader.
|
||||
*
|
||||
* $loader = new \Composer\Autoload\ClassLoader();
|
||||
*
|
||||
* // register classes with namespaces
|
||||
* $loader->add('Symfony\Component', __DIR__.'/component');
|
||||
* $loader->add('Symfony', __DIR__.'/framework');
|
||||
*
|
||||
* // activate the autoloader
|
||||
* $loader->register();
|
||||
*
|
||||
* // to enable searching the include path (eg. for PEAR packages)
|
||||
* $loader->setUseIncludePath(true);
|
||||
*
|
||||
* In this example, if you try to use a class in the Symfony\Component
|
||||
* namespace or one of its children (Symfony\Component\Console for instance),
|
||||
* the autoloader will first look for the class under the component/
|
||||
* directory, and it will then fallback to the framework/ directory if not
|
||||
* found before giving up.
|
||||
*
|
||||
* This class is loosely based on the Symfony UniversalClassLoader.
|
||||
*
|
||||
* @author Fabien Potencier <fabien@symfony.com>
|
||||
* @author Jordi Boggiano <j.boggiano@seld.be>
|
||||
* @see http://www.php-fig.org/psr/psr-0/
|
||||
* @see http://www.php-fig.org/psr/psr-4/
|
||||
*/
|
||||
class ClassLoader
|
||||
{
|
||||
// PSR-4
|
||||
private $prefixLengthsPsr4 = array();
|
||||
private $prefixDirsPsr4 = array();
|
||||
private $fallbackDirsPsr4 = array();
|
||||
|
||||
// PSR-0
|
||||
private $prefixesPsr0 = array();
|
||||
private $fallbackDirsPsr0 = array();
|
||||
|
||||
private $useIncludePath = false;
|
||||
private $classMap = array();
|
||||
private $classMapAuthoritative = false;
|
||||
private $missingClasses = array();
|
||||
private $apcuPrefix;
|
||||
|
||||
public function getPrefixes()
|
||||
{
|
||||
if (!empty($this->prefixesPsr0)) {
|
||||
return call_user_func_array('array_merge', $this->prefixesPsr0);
|
||||
}
|
||||
|
||||
return array();
|
||||
}
|
||||
|
||||
public function getPrefixesPsr4()
|
||||
{
|
||||
return $this->prefixDirsPsr4;
|
||||
}
|
||||
|
||||
public function getFallbackDirs()
|
||||
{
|
||||
return $this->fallbackDirsPsr0;
|
||||
}
|
||||
|
||||
public function getFallbackDirsPsr4()
|
||||
{
|
||||
return $this->fallbackDirsPsr4;
|
||||
}
|
||||
|
||||
public function getClassMap()
|
||||
{
|
||||
return $this->classMap;
|
||||
}
|
||||
|
||||
/**
|
||||
* @param array $classMap Class to filename map
|
||||
*/
|
||||
public function addClassMap(array $classMap)
|
||||
{
|
||||
if ($this->classMap) {
|
||||
$this->classMap = array_merge($this->classMap, $classMap);
|
||||
} else {
|
||||
$this->classMap = $classMap;
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Registers a set of PSR-0 directories for a given prefix, either
|
||||
* appending or prepending to the ones previously set for this prefix.
|
||||
*
|
||||
* @param string $prefix The prefix
|
||||
* @param array|string $paths The PSR-0 root directories
|
||||
* @param bool $prepend Whether to prepend the directories
|
||||
*/
|
||||
public function add($prefix, $paths, $prepend = false)
|
||||
{
|
||||
if (!$prefix) {
|
||||
if ($prepend) {
|
||||
$this->fallbackDirsPsr0 = array_merge(
|
||||
(array) $paths,
|
||||
$this->fallbackDirsPsr0
|
||||
);
|
||||
} else {
|
||||
$this->fallbackDirsPsr0 = array_merge(
|
||||
$this->fallbackDirsPsr0,
|
||||
(array) $paths
|
||||
);
|
||||
}
|
||||
|
||||
return;
|
||||
}
|
||||
|
||||
$first = $prefix[0];
|
||||
if (!isset($this->prefixesPsr0[$first][$prefix])) {
|
||||
$this->prefixesPsr0[$first][$prefix] = (array) $paths;
|
||||
|
||||
return;
|
||||
}
|
||||
if ($prepend) {
|
||||
$this->prefixesPsr0[$first][$prefix] = array_merge(
|
||||
(array) $paths,
|
||||
$this->prefixesPsr0[$first][$prefix]
|
||||
);
|
||||
} else {
|
||||
$this->prefixesPsr0[$first][$prefix] = array_merge(
|
||||
$this->prefixesPsr0[$first][$prefix],
|
||||
(array) $paths
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Registers a set of PSR-4 directories for a given namespace, either
|
||||
* appending or prepending to the ones previously set for this namespace.
|
||||
*
|
||||
* @param string $prefix The prefix/namespace, with trailing '\\'
|
||||
* @param array|string $paths The PSR-4 base directories
|
||||
* @param bool $prepend Whether to prepend the directories
|
||||
*
|
||||
* @throws \InvalidArgumentException
|
||||
*/
|
||||
public function addPsr4($prefix, $paths, $prepend = false)
|
||||
{
|
||||
if (!$prefix) {
|
||||
// Register directories for the root namespace.
|
||||
if ($prepend) {
|
||||
$this->fallbackDirsPsr4 = array_merge(
|
||||
(array) $paths,
|
||||
$this->fallbackDirsPsr4
|
||||
);
|
||||
} else {
|
||||
$this->fallbackDirsPsr4 = array_merge(
|
||||
$this->fallbackDirsPsr4,
|
||||
(array) $paths
|
||||
);
|
||||
}
|
||||
} elseif (!isset($this->prefixDirsPsr4[$prefix])) {
|
||||
// Register directories for a new namespace.
|
||||
$length = strlen($prefix);
|
||||
if ('\\' !== $prefix[$length - 1]) {
|
||||
throw new \InvalidArgumentException("A non-empty PSR-4 prefix must end with a namespace separator.");
|
||||
}
|
||||
$this->prefixLengthsPsr4[$prefix[0]][$prefix] = $length;
|
||||
$this->prefixDirsPsr4[$prefix] = (array) $paths;
|
||||
} elseif ($prepend) {
|
||||
// Prepend directories for an already registered namespace.
|
||||
$this->prefixDirsPsr4[$prefix] = array_merge(
|
||||
(array) $paths,
|
||||
$this->prefixDirsPsr4[$prefix]
|
||||
);
|
||||
} else {
|
||||
// Append directories for an already registered namespace.
|
||||
$this->prefixDirsPsr4[$prefix] = array_merge(
|
||||
$this->prefixDirsPsr4[$prefix],
|
||||
(array) $paths
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Registers a set of PSR-0 directories for a given prefix,
|
||||
* replacing any others previously set for this prefix.
|
||||
*
|
||||
* @param string $prefix The prefix
|
||||
* @param array|string $paths The PSR-0 base directories
|
||||
*/
|
||||
public function set($prefix, $paths)
|
||||
{
|
||||
if (!$prefix) {
|
||||
$this->fallbackDirsPsr0 = (array) $paths;
|
||||
} else {
|
||||
$this->prefixesPsr0[$prefix[0]][$prefix] = (array) $paths;
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Registers a set of PSR-4 directories for a given namespace,
|
||||
* replacing any others previously set for this namespace.
|
||||
*
|
||||
* @param string $prefix The prefix/namespace, with trailing '\\'
|
||||
* @param array|string $paths The PSR-4 base directories
|
||||
*
|
||||
* @throws \InvalidArgumentException
|
||||
*/
|
||||
public function setPsr4($prefix, $paths)
|
||||
{
|
||||
if (!$prefix) {
|
||||
$this->fallbackDirsPsr4 = (array) $paths;
|
||||
} else {
|
||||
$length = strlen($prefix);
|
||||
if ('\\' !== $prefix[$length - 1]) {
|
||||
throw new \InvalidArgumentException("A non-empty PSR-4 prefix must end with a namespace separator.");
|
||||
}
|
||||
$this->prefixLengthsPsr4[$prefix[0]][$prefix] = $length;
|
||||
$this->prefixDirsPsr4[$prefix] = (array) $paths;
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Turns on searching the include path for class files.
|
||||
*
|
||||
* @param bool $useIncludePath
|
||||
*/
|
||||
public function setUseIncludePath($useIncludePath)
|
||||
{
|
||||
$this->useIncludePath = $useIncludePath;
|
||||
}
|
||||
|
||||
/**
|
||||
* Can be used to check if the autoloader uses the include path to check
|
||||
* for classes.
|
||||
*
|
||||
* @return bool
|
||||
*/
|
||||
public function getUseIncludePath()
|
||||
{
|
||||
return $this->useIncludePath;
|
||||
}
|
||||
|
||||
/**
|
||||
* Turns off searching the prefix and fallback directories for classes
|
||||
* that have not been registered with the class map.
|
||||
*
|
||||
* @param bool $classMapAuthoritative
|
||||
*/
|
||||
public function setClassMapAuthoritative($classMapAuthoritative)
|
||||
{
|
||||
$this->classMapAuthoritative = $classMapAuthoritative;
|
||||
}
|
||||
|
||||
/**
|
||||
* Should class lookup fail if not found in the current class map?
|
||||
*
|
||||
* @return bool
|
||||
*/
|
||||
public function isClassMapAuthoritative()
|
||||
{
|
||||
return $this->classMapAuthoritative;
|
||||
}
|
||||
|
||||
/**
|
||||
* APCu prefix to use to cache found/not-found classes, if the extension is enabled.
|
||||
*
|
||||
* @param string|null $apcuPrefix
|
||||
*/
|
||||
public function setApcuPrefix($apcuPrefix)
|
||||
{
|
||||
$this->apcuPrefix = function_exists('apcu_fetch') && ini_get('apc.enabled') ? $apcuPrefix : null;
|
||||
}
|
||||
|
||||
/**
|
||||
* The APCu prefix in use, or null if APCu caching is not enabled.
|
||||
*
|
||||
* @return string|null
|
||||
*/
|
||||
public function getApcuPrefix()
|
||||
{
|
||||
return $this->apcuPrefix;
|
||||
}
|
||||
|
||||
/**
|
||||
* Registers this instance as an autoloader.
|
||||
*
|
||||
* @param bool $prepend Whether to prepend the autoloader or not
|
||||
*/
|
||||
public function register($prepend = false)
|
||||
{
|
||||
spl_autoload_register(array($this, 'loadClass'), true, $prepend);
|
||||
}
|
||||
|
||||
/**
|
||||
* Unregisters this instance as an autoloader.
|
||||
*/
|
||||
public function unregister()
|
||||
{
|
||||
spl_autoload_unregister(array($this, 'loadClass'));
|
||||
}
|
||||
|
||||
/**
|
||||
* Loads the given class or interface.
|
||||
*
|
||||
* @param string $class The name of the class
|
||||
* @return bool|null True if loaded, null otherwise
|
||||
*/
|
||||
public function loadClass($class)
|
||||
{
|
||||
if ($file = $this->findFile($class)) {
|
||||
includeFile($file);
|
||||
|
||||
return true;
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Finds the path to the file where the class is defined.
|
||||
*
|
||||
* @param string $class The name of the class
|
||||
*
|
||||
* @return string|false The path if found, false otherwise
|
||||
*/
|
||||
public function findFile($class)
|
||||
{
|
||||
// class map lookup
|
||||
if (isset($this->classMap[$class])) {
|
||||
return $this->classMap[$class];
|
||||
}
|
||||
if ($this->classMapAuthoritative || isset($this->missingClasses[$class])) {
|
||||
return false;
|
||||
}
|
||||
if (null !== $this->apcuPrefix) {
|
||||
$file = apcu_fetch($this->apcuPrefix.$class, $hit);
|
||||
if ($hit) {
|
||||
return $file;
|
||||
}
|
||||
}
|
||||
|
||||
$file = $this->findFileWithExtension($class, '.php');
|
||||
|
||||
// Search for Hack files if we are running on HHVM
|
||||
if (false === $file && defined('HHVM_VERSION')) {
|
||||
$file = $this->findFileWithExtension($class, '.hh');
|
||||
}
|
||||
|
||||
if (null !== $this->apcuPrefix) {
|
||||
apcu_add($this->apcuPrefix.$class, $file);
|
||||
}
|
||||
|
||||
if (false === $file) {
|
||||
// Remember that this class does not exist.
|
||||
$this->missingClasses[$class] = true;
|
||||
}
|
||||
|
||||
return $file;
|
||||
}
|
||||
|
||||
private function findFileWithExtension($class, $ext)
|
||||
{
|
||||
// PSR-4 lookup
|
||||
$logicalPathPsr4 = strtr($class, '\\', DIRECTORY_SEPARATOR) . $ext;
|
||||
|
||||
$first = $class[0];
|
||||
if (isset($this->prefixLengthsPsr4[$first])) {
|
||||
$subPath = $class;
|
||||
while (false !== $lastPos = strrpos($subPath, '\\')) {
|
||||
$subPath = substr($subPath, 0, $lastPos);
|
||||
$search = $subPath.'\\';
|
||||
if (isset($this->prefixDirsPsr4[$search])) {
|
||||
foreach ($this->prefixDirsPsr4[$search] as $dir) {
|
||||
$length = $this->prefixLengthsPsr4[$first][$search];
|
||||
if (file_exists($file = $dir . DIRECTORY_SEPARATOR . substr($logicalPathPsr4, $length))) {
|
||||
return $file;
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// PSR-4 fallback dirs
|
||||
foreach ($this->fallbackDirsPsr4 as $dir) {
|
||||
if (file_exists($file = $dir . DIRECTORY_SEPARATOR . $logicalPathPsr4)) {
|
||||
return $file;
|
||||
}
|
||||
}
|
||||
|
||||
// PSR-0 lookup
|
||||
if (false !== $pos = strrpos($class, '\\')) {
|
||||
// namespaced class name
|
||||
$logicalPathPsr0 = substr($logicalPathPsr4, 0, $pos + 1)
|
||||
. strtr(substr($logicalPathPsr4, $pos + 1), '_', DIRECTORY_SEPARATOR);
|
||||
} else {
|
||||
// PEAR-like class name
|
||||
$logicalPathPsr0 = strtr($class, '_', DIRECTORY_SEPARATOR) . $ext;
|
||||
}
|
||||
|
||||
if (isset($this->prefixesPsr0[$first])) {
|
||||
foreach ($this->prefixesPsr0[$first] as $prefix => $dirs) {
|
||||
if (0 === strpos($class, $prefix)) {
|
||||
foreach ($dirs as $dir) {
|
||||
if (file_exists($file = $dir . DIRECTORY_SEPARATOR . $logicalPathPsr0)) {
|
||||
return $file;
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// PSR-0 fallback dirs
|
||||
foreach ($this->fallbackDirsPsr0 as $dir) {
|
||||
if (file_exists($file = $dir . DIRECTORY_SEPARATOR . $logicalPathPsr0)) {
|
||||
return $file;
|
||||
}
|
||||
}
|
||||
|
||||
// PSR-0 include paths.
|
||||
if ($this->useIncludePath && $file = stream_resolve_include_path($logicalPathPsr0)) {
|
||||
return $file;
|
||||
}
|
||||
|
||||
return false;
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Scope isolated include.
|
||||
*
|
||||
* Prevents access to $this/self from included files.
|
||||
*/
|
||||
function includeFile($file)
|
||||
{
|
||||
include $file;
|
||||
}
|
||||
21
backend/wp-content/plugins/jwt-authentication-for-wp-rest-api/includes/vendor/composer/LICENSE
vendored
Normal file
21
backend/wp-content/plugins/jwt-authentication-for-wp-rest-api/includes/vendor/composer/LICENSE
vendored
Normal file
@@ -0,0 +1,21 @@
|
||||
|
||||
Copyright (c) Nils Adermann, Jordi Boggiano
|
||||
|
||||
Permission is hereby granted, free of charge, to any person obtaining a copy
|
||||
of this software and associated documentation files (the "Software"), to deal
|
||||
in the Software without restriction, including without limitation the rights
|
||||
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
||||
copies of the Software, and to permit persons to whom the Software is furnished
|
||||
to do so, subject to the following conditions:
|
||||
|
||||
The above copyright notice and this permission notice shall be included in all
|
||||
copies or substantial portions of the Software.
|
||||
|
||||
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
||||
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
||||
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
||||
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
||||
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
||||
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
|
||||
THE SOFTWARE.
|
||||
|
||||
@@ -0,0 +1,9 @@
|
||||
<?php
|
||||
|
||||
// autoload_classmap.php @generated by Composer
|
||||
|
||||
$vendorDir = dirname(dirname(__FILE__));
|
||||
$baseDir = dirname(dirname($vendorDir));
|
||||
|
||||
return array(
|
||||
);
|
||||
@@ -0,0 +1,9 @@
|
||||
<?php
|
||||
|
||||
// autoload_namespaces.php @generated by Composer
|
||||
|
||||
$vendorDir = dirname(dirname(__FILE__));
|
||||
$baseDir = dirname(dirname($vendorDir));
|
||||
|
||||
return array(
|
||||
);
|
||||
@@ -0,0 +1,10 @@
|
||||
<?php
|
||||
|
||||
// autoload_psr4.php @generated by Composer
|
||||
|
||||
$vendorDir = dirname(dirname(__FILE__));
|
||||
$baseDir = dirname(dirname($vendorDir));
|
||||
|
||||
return array(
|
||||
'Firebase\\JWT\\' => array($vendorDir . '/firebase/php-jwt/src'),
|
||||
);
|
||||
@@ -0,0 +1,52 @@
|
||||
<?php
|
||||
|
||||
// autoload_real.php @generated by Composer
|
||||
|
||||
class ComposerAutoloaderInit6ba6ee55693d165c056f65e51c5383a5
|
||||
{
|
||||
private static $loader;
|
||||
|
||||
public static function loadClassLoader($class)
|
||||
{
|
||||
if ('Composer\Autoload\ClassLoader' === $class) {
|
||||
require __DIR__ . '/ClassLoader.php';
|
||||
}
|
||||
}
|
||||
|
||||
public static function getLoader()
|
||||
{
|
||||
if (null !== self::$loader) {
|
||||
return self::$loader;
|
||||
}
|
||||
|
||||
spl_autoload_register(array('ComposerAutoloaderInit6ba6ee55693d165c056f65e51c5383a5', 'loadClassLoader'), true, true);
|
||||
self::$loader = $loader = new \Composer\Autoload\ClassLoader();
|
||||
spl_autoload_unregister(array('ComposerAutoloaderInit6ba6ee55693d165c056f65e51c5383a5', 'loadClassLoader'));
|
||||
|
||||
$useStaticLoader = PHP_VERSION_ID >= 50600 && !defined('HHVM_VERSION') && (!function_exists('zend_loader_file_encoded') || !zend_loader_file_encoded());
|
||||
if ($useStaticLoader) {
|
||||
require_once __DIR__ . '/autoload_static.php';
|
||||
|
||||
call_user_func(\Composer\Autoload\ComposerStaticInit6ba6ee55693d165c056f65e51c5383a5::getInitializer($loader));
|
||||
} else {
|
||||
$map = require __DIR__ . '/autoload_namespaces.php';
|
||||
foreach ($map as $namespace => $path) {
|
||||
$loader->set($namespace, $path);
|
||||
}
|
||||
|
||||
$map = require __DIR__ . '/autoload_psr4.php';
|
||||
foreach ($map as $namespace => $path) {
|
||||
$loader->setPsr4($namespace, $path);
|
||||
}
|
||||
|
||||
$classMap = require __DIR__ . '/autoload_classmap.php';
|
||||
if ($classMap) {
|
||||
$loader->addClassMap($classMap);
|
||||
}
|
||||
}
|
||||
|
||||
$loader->register(true);
|
||||
|
||||
return $loader;
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,31 @@
|
||||
<?php
|
||||
|
||||
// autoload_static.php @generated by Composer
|
||||
|
||||
namespace Composer\Autoload;
|
||||
|
||||
class ComposerStaticInit6ba6ee55693d165c056f65e51c5383a5
|
||||
{
|
||||
public static $prefixLengthsPsr4 = array (
|
||||
'F' =>
|
||||
array (
|
||||
'Firebase\\JWT\\' => 13,
|
||||
),
|
||||
);
|
||||
|
||||
public static $prefixDirsPsr4 = array (
|
||||
'Firebase\\JWT\\' =>
|
||||
array (
|
||||
0 => __DIR__ . '/..' . '/firebase/php-jwt/src',
|
||||
),
|
||||
);
|
||||
|
||||
public static function getInitializer(ClassLoader $loader)
|
||||
{
|
||||
return \Closure::bind(function () use ($loader) {
|
||||
$loader->prefixLengthsPsr4 = ComposerStaticInit6ba6ee55693d165c056f65e51c5383a5::$prefixLengthsPsr4;
|
||||
$loader->prefixDirsPsr4 = ComposerStaticInit6ba6ee55693d165c056f65e51c5383a5::$prefixDirsPsr4;
|
||||
|
||||
}, null, ClassLoader::class);
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,50 @@
|
||||
[
|
||||
{
|
||||
"name": "firebase/php-jwt",
|
||||
"version": "v5.0.0",
|
||||
"version_normalized": "5.0.0.0",
|
||||
"source": {
|
||||
"type": "git",
|
||||
"url": "https://github.com/firebase/php-jwt.git",
|
||||
"reference": "9984a4d3a32ae7673d6971ea00bae9d0a1abba0e"
|
||||
},
|
||||
"dist": {
|
||||
"type": "zip",
|
||||
"url": "https://api.github.com/repos/firebase/php-jwt/zipball/9984a4d3a32ae7673d6971ea00bae9d0a1abba0e",
|
||||
"reference": "9984a4d3a32ae7673d6971ea00bae9d0a1abba0e",
|
||||
"shasum": ""
|
||||
},
|
||||
"require": {
|
||||
"php": ">=5.3.0"
|
||||
},
|
||||
"require-dev": {
|
||||
"phpunit/phpunit": " 4.8.35"
|
||||
},
|
||||
"time": "2017-06-27T22:17:23+00:00",
|
||||
"type": "library",
|
||||
"installation-source": "dist",
|
||||
"autoload": {
|
||||
"psr-4": {
|
||||
"Firebase\\JWT\\": "src"
|
||||
}
|
||||
},
|
||||
"notification-url": "https://packagist.org/downloads/",
|
||||
"license": [
|
||||
"BSD-3-Clause"
|
||||
],
|
||||
"authors": [
|
||||
{
|
||||
"name": "Neuman Vong",
|
||||
"email": "neuman+pear@twilio.com",
|
||||
"role": "Developer"
|
||||
},
|
||||
{
|
||||
"name": "Anant Narayanan",
|
||||
"email": "anant@php.net",
|
||||
"role": "Developer"
|
||||
}
|
||||
],
|
||||
"description": "A simple library to encode and decode JSON Web Tokens (JWT) in PHP. Should conform to the current spec.",
|
||||
"homepage": "https://github.com/firebase/php-jwt"
|
||||
}
|
||||
]
|
||||
@@ -0,0 +1,30 @@
|
||||
Copyright (c) 2011, Neuman Vong
|
||||
|
||||
All rights reserved.
|
||||
|
||||
Redistribution and use in source and binary forms, with or without
|
||||
modification, are permitted provided that the following conditions are met:
|
||||
|
||||
* Redistributions of source code must retain the above copyright
|
||||
notice, this list of conditions and the following disclaimer.
|
||||
|
||||
* Redistributions in binary form must reproduce the above
|
||||
copyright notice, this list of conditions and the following
|
||||
disclaimer in the documentation and/or other materials provided
|
||||
with the distribution.
|
||||
|
||||
* Neither the name of Neuman Vong nor the names of other
|
||||
contributors may be used to endorse or promote products derived
|
||||
from this software without specific prior written permission.
|
||||
|
||||
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
|
||||
"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
|
||||
LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
|
||||
A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
|
||||
OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
||||
SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
|
||||
LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
|
||||
DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
|
||||
THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
|
||||
(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
|
||||
OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
@@ -0,0 +1,200 @@
|
||||
[](https://travis-ci.org/firebase/php-jwt)
|
||||
[](https://packagist.org/packages/firebase/php-jwt)
|
||||
[](https://packagist.org/packages/firebase/php-jwt)
|
||||
[](https://packagist.org/packages/firebase/php-jwt)
|
||||
|
||||
PHP-JWT
|
||||
=======
|
||||
A simple library to encode and decode JSON Web Tokens (JWT) in PHP, conforming to [RFC 7519](https://tools.ietf.org/html/rfc7519).
|
||||
|
||||
Installation
|
||||
------------
|
||||
|
||||
Use composer to manage your dependencies and download PHP-JWT:
|
||||
|
||||
```bash
|
||||
composer require firebase/php-jwt
|
||||
```
|
||||
|
||||
Example
|
||||
-------
|
||||
```php
|
||||
<?php
|
||||
use \Firebase\JWT\JWT;
|
||||
|
||||
$key = "example_key";
|
||||
$token = array(
|
||||
"iss" => "http://example.org",
|
||||
"aud" => "http://example.com",
|
||||
"iat" => 1356999524,
|
||||
"nbf" => 1357000000
|
||||
);
|
||||
|
||||
/**
|
||||
* IMPORTANT:
|
||||
* You must specify supported algorithms for your application. See
|
||||
* https://tools.ietf.org/html/draft-ietf-jose-json-web-algorithms-40
|
||||
* for a list of spec-compliant algorithms.
|
||||
*/
|
||||
$jwt = JWT::encode($token, $key);
|
||||
$decoded = JWT::decode($jwt, $key, array('HS256'));
|
||||
|
||||
print_r($decoded);
|
||||
|
||||
/*
|
||||
NOTE: This will now be an object instead of an associative array. To get
|
||||
an associative array, you will need to cast it as such:
|
||||
*/
|
||||
|
||||
$decoded_array = (array) $decoded;
|
||||
|
||||
/**
|
||||
* You can add a leeway to account for when there is a clock skew times between
|
||||
* the signing and verifying servers. It is recommended that this leeway should
|
||||
* not be bigger than a few minutes.
|
||||
*
|
||||
* Source: http://self-issued.info/docs/draft-ietf-oauth-json-web-token.html#nbfDef
|
||||
*/
|
||||
JWT::$leeway = 60; // $leeway in seconds
|
||||
$decoded = JWT::decode($jwt, $key, array('HS256'));
|
||||
|
||||
?>
|
||||
```
|
||||
Example with RS256 (openssl)
|
||||
----------------------------
|
||||
```php
|
||||
<?php
|
||||
use \Firebase\JWT\JWT;
|
||||
|
||||
$privateKey = <<<EOD
|
||||
-----BEGIN RSA PRIVATE KEY-----
|
||||
MIICXAIBAAKBgQC8kGa1pSjbSYZVebtTRBLxBz5H4i2p/llLCrEeQhta5kaQu/Rn
|
||||
vuER4W8oDH3+3iuIYW4VQAzyqFpwuzjkDI+17t5t0tyazyZ8JXw+KgXTxldMPEL9
|
||||
5+qVhgXvwtihXC1c5oGbRlEDvDF6Sa53rcFVsYJ4ehde/zUxo6UvS7UrBQIDAQAB
|
||||
AoGAb/MXV46XxCFRxNuB8LyAtmLDgi/xRnTAlMHjSACddwkyKem8//8eZtw9fzxz
|
||||
bWZ/1/doQOuHBGYZU8aDzzj59FZ78dyzNFoF91hbvZKkg+6wGyd/LrGVEB+Xre0J
|
||||
Nil0GReM2AHDNZUYRv+HYJPIOrB0CRczLQsgFJ8K6aAD6F0CQQDzbpjYdx10qgK1
|
||||
cP59UHiHjPZYC0loEsk7s+hUmT3QHerAQJMZWC11Qrn2N+ybwwNblDKv+s5qgMQ5
|
||||
5tNoQ9IfAkEAxkyffU6ythpg/H0Ixe1I2rd0GbF05biIzO/i77Det3n4YsJVlDck
|
||||
ZkcvY3SK2iRIL4c9yY6hlIhs+K9wXTtGWwJBAO9Dskl48mO7woPR9uD22jDpNSwe
|
||||
k90OMepTjzSvlhjbfuPN1IdhqvSJTDychRwn1kIJ7LQZgQ8fVz9OCFZ/6qMCQGOb
|
||||
qaGwHmUK6xzpUbbacnYrIM6nLSkXgOAwv7XXCojvY614ILTK3iXiLBOxPu5Eu13k
|
||||
eUz9sHyD6vkgZzjtxXECQAkp4Xerf5TGfQXGXhxIX52yH+N2LtujCdkQZjXAsGdm
|
||||
B2zNzvrlgRmgBrklMTrMYgm1NPcW+bRLGcwgW2PTvNM=
|
||||
-----END RSA PRIVATE KEY-----
|
||||
EOD;
|
||||
|
||||
$publicKey = <<<EOD
|
||||
-----BEGIN PUBLIC KEY-----
|
||||
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC8kGa1pSjbSYZVebtTRBLxBz5H
|
||||
4i2p/llLCrEeQhta5kaQu/RnvuER4W8oDH3+3iuIYW4VQAzyqFpwuzjkDI+17t5t
|
||||
0tyazyZ8JXw+KgXTxldMPEL95+qVhgXvwtihXC1c5oGbRlEDvDF6Sa53rcFVsYJ4
|
||||
ehde/zUxo6UvS7UrBQIDAQAB
|
||||
-----END PUBLIC KEY-----
|
||||
EOD;
|
||||
|
||||
$token = array(
|
||||
"iss" => "example.org",
|
||||
"aud" => "example.com",
|
||||
"iat" => 1356999524,
|
||||
"nbf" => 1357000000
|
||||
);
|
||||
|
||||
$jwt = JWT::encode($token, $privateKey, 'RS256');
|
||||
echo "Encode:\n" . print_r($jwt, true) . "\n";
|
||||
|
||||
$decoded = JWT::decode($jwt, $publicKey, array('RS256'));
|
||||
|
||||
/*
|
||||
NOTE: This will now be an object instead of an associative array. To get
|
||||
an associative array, you will need to cast it as such:
|
||||
*/
|
||||
|
||||
$decoded_array = (array) $decoded;
|
||||
echo "Decode:\n" . print_r($decoded_array, true) . "\n";
|
||||
?>
|
||||
```
|
||||
|
||||
Changelog
|
||||
---------
|
||||
|
||||
#### 5.0.0 / 2017-06-26
|
||||
- Support RS384 and RS512.
|
||||
See [#117](https://github.com/firebase/php-jwt/pull/117). Thanks [@joostfaassen](https://github.com/joostfaassen)!
|
||||
- Add an example for RS256 openssl.
|
||||
See [#125](https://github.com/firebase/php-jwt/pull/125). Thanks [@akeeman](https://github.com/akeeman)!
|
||||
- Detect invalid Base64 encoding in signature.
|
||||
See [#162](https://github.com/firebase/php-jwt/pull/162). Thanks [@psignoret](https://github.com/psignoret)!
|
||||
- Update `JWT::verify` to handle OpenSSL errors.
|
||||
See [#159](https://github.com/firebase/php-jwt/pull/159). Thanks [@bshaffer](https://github.com/bshaffer)!
|
||||
- Add `array` type hinting to `decode` method
|
||||
See [#101](https://github.com/firebase/php-jwt/pull/101). Thanks [@hywak](https://github.com/hywak)!
|
||||
- Add all JSON error types.
|
||||
See [#110](https://github.com/firebase/php-jwt/pull/110). Thanks [@gbalduzzi](https://github.com/gbalduzzi)!
|
||||
- Bugfix 'kid' not in given key list.
|
||||
See [#129](https://github.com/firebase/php-jwt/pull/129). Thanks [@stampycode](https://github.com/stampycode)!
|
||||
- Miscellaneous cleanup, documentation and test fixes.
|
||||
See [#107](https://github.com/firebase/php-jwt/pull/107), [#115](https://github.com/firebase/php-jwt/pull/115),
|
||||
[#160](https://github.com/firebase/php-jwt/pull/160), [#161](https://github.com/firebase/php-jwt/pull/161), and
|
||||
[#165](https://github.com/firebase/php-jwt/pull/165). Thanks [@akeeman](https://github.com/akeeman),
|
||||
[@chinedufn](https://github.com/chinedufn), and [@bshaffer](https://github.com/bshaffer)!
|
||||
|
||||
#### 4.0.0 / 2016-07-17
|
||||
- Add support for late static binding. See [#88](https://github.com/firebase/php-jwt/pull/88) for details. Thanks to [@chappy84](https://github.com/chappy84)!
|
||||
- Use static `$timestamp` instead of `time()` to improve unit testing. See [#93](https://github.com/firebase/php-jwt/pull/93) for details. Thanks to [@josephmcdermott](https://github.com/josephmcdermott)!
|
||||
- Fixes to exceptions classes. See [#81](https://github.com/firebase/php-jwt/pull/81) for details. Thanks to [@Maks3w](https://github.com/Maks3w)!
|
||||
- Fixes to PHPDoc. See [#76](https://github.com/firebase/php-jwt/pull/76) for details. Thanks to [@akeeman](https://github.com/akeeman)!
|
||||
|
||||
#### 3.0.0 / 2015-07-22
|
||||
- Minimum PHP version updated from `5.2.0` to `5.3.0`.
|
||||
- Add `\Firebase\JWT` namespace. See
|
||||
[#59](https://github.com/firebase/php-jwt/pull/59) for details. Thanks to
|
||||
[@Dashron](https://github.com/Dashron)!
|
||||
- Require a non-empty key to decode and verify a JWT. See
|
||||
[#60](https://github.com/firebase/php-jwt/pull/60) for details. Thanks to
|
||||
[@sjones608](https://github.com/sjones608)!
|
||||
- Cleaner documentation blocks in the code. See
|
||||
[#62](https://github.com/firebase/php-jwt/pull/62) for details. Thanks to
|
||||
[@johanderuijter](https://github.com/johanderuijter)!
|
||||
|
||||
#### 2.2.0 / 2015-06-22
|
||||
- Add support for adding custom, optional JWT headers to `JWT::encode()`. See
|
||||
[#53](https://github.com/firebase/php-jwt/pull/53/files) for details. Thanks to
|
||||
[@mcocaro](https://github.com/mcocaro)!
|
||||
|
||||
#### 2.1.0 / 2015-05-20
|
||||
- Add support for adding a leeway to `JWT:decode()` that accounts for clock skew
|
||||
between signing and verifying entities. Thanks to [@lcabral](https://github.com/lcabral)!
|
||||
- Add support for passing an object implementing the `ArrayAccess` interface for
|
||||
`$keys` argument in `JWT::decode()`. Thanks to [@aztech-dev](https://github.com/aztech-dev)!
|
||||
|
||||
#### 2.0.0 / 2015-04-01
|
||||
- **Note**: It is strongly recommended that you update to > v2.0.0 to address
|
||||
known security vulnerabilities in prior versions when both symmetric and
|
||||
asymmetric keys are used together.
|
||||
- Update signature for `JWT::decode(...)` to require an array of supported
|
||||
algorithms to use when verifying token signatures.
|
||||
|
||||
|
||||
Tests
|
||||
-----
|
||||
Run the tests using phpunit:
|
||||
|
||||
```bash
|
||||
$ pear install PHPUnit
|
||||
$ phpunit --configuration phpunit.xml.dist
|
||||
PHPUnit 3.7.10 by Sebastian Bergmann.
|
||||
.....
|
||||
Time: 0 seconds, Memory: 2.50Mb
|
||||
OK (5 tests, 5 assertions)
|
||||
```
|
||||
|
||||
New Lines in private keys
|
||||
-----
|
||||
|
||||
If your private key contains `\n` characters, be sure to wrap it in double quotes `""`
|
||||
and not single quotes `''` in order to properly interpret the escaped characters.
|
||||
|
||||
License
|
||||
-------
|
||||
[3-Clause BSD](http://opensource.org/licenses/BSD-3-Clause).
|
||||
@@ -0,0 +1,29 @@
|
||||
{
|
||||
"name": "firebase/php-jwt",
|
||||
"description": "A simple library to encode and decode JSON Web Tokens (JWT) in PHP. Should conform to the current spec.",
|
||||
"homepage": "https://github.com/firebase/php-jwt",
|
||||
"authors": [
|
||||
{
|
||||
"name": "Neuman Vong",
|
||||
"email": "neuman+pear@twilio.com",
|
||||
"role": "Developer"
|
||||
},
|
||||
{
|
||||
"name": "Anant Narayanan",
|
||||
"email": "anant@php.net",
|
||||
"role": "Developer"
|
||||
}
|
||||
],
|
||||
"license": "BSD-3-Clause",
|
||||
"require": {
|
||||
"php": ">=5.3.0"
|
||||
},
|
||||
"autoload": {
|
||||
"psr-4": {
|
||||
"Firebase\\JWT\\": "src"
|
||||
}
|
||||
},
|
||||
"require-dev": {
|
||||
"phpunit/phpunit": " 4.8.35"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,7 @@
|
||||
<?php
|
||||
namespace Firebase\JWT;
|
||||
|
||||
class BeforeValidException extends \UnexpectedValueException
|
||||
{
|
||||
|
||||
}
|
||||
@@ -0,0 +1,7 @@
|
||||
<?php
|
||||
namespace Firebase\JWT;
|
||||
|
||||
class ExpiredException extends \UnexpectedValueException
|
||||
{
|
||||
|
||||
}
|
||||
@@ -0,0 +1,379 @@
|
||||
<?php
|
||||
|
||||
namespace Firebase\JWT;
|
||||
use \DomainException;
|
||||
use \InvalidArgumentException;
|
||||
use \UnexpectedValueException;
|
||||
use \DateTime;
|
||||
|
||||
/**
|
||||
* JSON Web Token implementation, based on this spec:
|
||||
* https://tools.ietf.org/html/rfc7519
|
||||
*
|
||||
* PHP version 5
|
||||
*
|
||||
* @category Authentication
|
||||
* @package Authentication_JWT
|
||||
* @author Neuman Vong <neuman@twilio.com>
|
||||
* @author Anant Narayanan <anant@php.net>
|
||||
* @license http://opensource.org/licenses/BSD-3-Clause 3-clause BSD
|
||||
* @link https://github.com/firebase/php-jwt
|
||||
*/
|
||||
class JWT
|
||||
{
|
||||
|
||||
/**
|
||||
* When checking nbf, iat or expiration times,
|
||||
* we want to provide some extra leeway time to
|
||||
* account for clock skew.
|
||||
*/
|
||||
public static $leeway = 0;
|
||||
|
||||
/**
|
||||
* Allow the current timestamp to be specified.
|
||||
* Useful for fixing a value within unit testing.
|
||||
*
|
||||
* Will default to PHP time() value if null.
|
||||
*/
|
||||
public static $timestamp = null;
|
||||
|
||||
public static $supported_algs = array(
|
||||
'HS256' => array('hash_hmac', 'SHA256'),
|
||||
'HS512' => array('hash_hmac', 'SHA512'),
|
||||
'HS384' => array('hash_hmac', 'SHA384'),
|
||||
'RS256' => array('openssl', 'SHA256'),
|
||||
'RS384' => array('openssl', 'SHA384'),
|
||||
'RS512' => array('openssl', 'SHA512'),
|
||||
);
|
||||
|
||||
/**
|
||||
* Decodes a JWT string into a PHP object.
|
||||
*
|
||||
* @param string $jwt The JWT
|
||||
* @param string|array $key The key, or map of keys.
|
||||
* If the algorithm used is asymmetric, this is the public key
|
||||
* @param array $allowed_algs List of supported verification algorithms
|
||||
* Supported algorithms are 'HS256', 'HS384', 'HS512' and 'RS256'
|
||||
*
|
||||
* @return object The JWT's payload as a PHP object
|
||||
*
|
||||
* @throws UnexpectedValueException Provided JWT was invalid
|
||||
* @throws SignatureInvalidException Provided JWT was invalid because the signature verification failed
|
||||
* @throws BeforeValidException Provided JWT is trying to be used before it's eligible as defined by 'nbf'
|
||||
* @throws BeforeValidException Provided JWT is trying to be used before it's been created as defined by 'iat'
|
||||
* @throws ExpiredException Provided JWT has since expired, as defined by the 'exp' claim
|
||||
*
|
||||
* @uses jsonDecode
|
||||
* @uses urlsafeB64Decode
|
||||
*/
|
||||
public static function decode($jwt, $key, array $allowed_algs = array())
|
||||
{
|
||||
$timestamp = is_null(static::$timestamp) ? time() : static::$timestamp;
|
||||
|
||||
if (empty($key)) {
|
||||
throw new InvalidArgumentException('Key may not be empty');
|
||||
}
|
||||
$tks = explode('.', $jwt);
|
||||
if (count($tks) != 3) {
|
||||
throw new UnexpectedValueException('Wrong number of segments');
|
||||
}
|
||||
list($headb64, $bodyb64, $cryptob64) = $tks;
|
||||
if (null === ($header = static::jsonDecode(static::urlsafeB64Decode($headb64)))) {
|
||||
throw new UnexpectedValueException('Invalid header encoding');
|
||||
}
|
||||
if (null === $payload = static::jsonDecode(static::urlsafeB64Decode($bodyb64))) {
|
||||
throw new UnexpectedValueException('Invalid claims encoding');
|
||||
}
|
||||
if (false === ($sig = static::urlsafeB64Decode($cryptob64))) {
|
||||
throw new UnexpectedValueException('Invalid signature encoding');
|
||||
}
|
||||
if (empty($header->alg)) {
|
||||
throw new UnexpectedValueException('Empty algorithm');
|
||||
}
|
||||
if (empty(static::$supported_algs[$header->alg])) {
|
||||
throw new UnexpectedValueException('Algorithm not supported');
|
||||
}
|
||||
if (!in_array($header->alg, $allowed_algs)) {
|
||||
throw new UnexpectedValueException('Algorithm not allowed');
|
||||
}
|
||||
if (is_array($key) || $key instanceof \ArrayAccess) {
|
||||
if (isset($header->kid)) {
|
||||
if (!isset($key[$header->kid])) {
|
||||
throw new UnexpectedValueException('"kid" invalid, unable to lookup correct key');
|
||||
}
|
||||
$key = $key[$header->kid];
|
||||
} else {
|
||||
throw new UnexpectedValueException('"kid" empty, unable to lookup correct key');
|
||||
}
|
||||
}
|
||||
|
||||
// Check the signature
|
||||
if (!static::verify("$headb64.$bodyb64", $sig, $key, $header->alg)) {
|
||||
throw new SignatureInvalidException('Signature verification failed');
|
||||
}
|
||||
|
||||
// Check if the nbf if it is defined. This is the time that the
|
||||
// token can actually be used. If it's not yet that time, abort.
|
||||
if (isset($payload->nbf) && $payload->nbf > ($timestamp + static::$leeway)) {
|
||||
throw new BeforeValidException(
|
||||
'Cannot handle token prior to ' . date(DateTime::ISO8601, $payload->nbf)
|
||||
);
|
||||
}
|
||||
|
||||
// Check that this token has been created before 'now'. This prevents
|
||||
// using tokens that have been created for later use (and haven't
|
||||
// correctly used the nbf claim).
|
||||
if (isset($payload->iat) && $payload->iat > ($timestamp + static::$leeway)) {
|
||||
throw new BeforeValidException(
|
||||
'Cannot handle token prior to ' . date(DateTime::ISO8601, $payload->iat)
|
||||
);
|
||||
}
|
||||
|
||||
// Check if this token has expired.
|
||||
if (isset($payload->exp) && ($timestamp - static::$leeway) >= $payload->exp) {
|
||||
throw new ExpiredException('Expired token');
|
||||
}
|
||||
|
||||
return $payload;
|
||||
}
|
||||
|
||||
/**
|
||||
* Converts and signs a PHP object or array into a JWT string.
|
||||
*
|
||||
* @param object|array $payload PHP object or array
|
||||
* @param string $key The secret key.
|
||||
* If the algorithm used is asymmetric, this is the private key
|
||||
* @param string $alg The signing algorithm.
|
||||
* Supported algorithms are 'HS256', 'HS384', 'HS512' and 'RS256'
|
||||
* @param mixed $keyId
|
||||
* @param array $head An array with header elements to attach
|
||||
*
|
||||
* @return string A signed JWT
|
||||
*
|
||||
* @uses jsonEncode
|
||||
* @uses urlsafeB64Encode
|
||||
*/
|
||||
public static function encode($payload, $key, $alg = 'HS256', $keyId = null, $head = null)
|
||||
{
|
||||
$header = array('typ' => 'JWT', 'alg' => $alg);
|
||||
if ($keyId !== null) {
|
||||
$header['kid'] = $keyId;
|
||||
}
|
||||
if ( isset($head) && is_array($head) ) {
|
||||
$header = array_merge($head, $header);
|
||||
}
|
||||
$segments = array();
|
||||
$segments[] = static::urlsafeB64Encode(static::jsonEncode($header));
|
||||
$segments[] = static::urlsafeB64Encode(static::jsonEncode($payload));
|
||||
$signing_input = implode('.', $segments);
|
||||
|
||||
$signature = static::sign($signing_input, $key, $alg);
|
||||
$segments[] = static::urlsafeB64Encode($signature);
|
||||
|
||||
return implode('.', $segments);
|
||||
}
|
||||
|
||||
/**
|
||||
* Sign a string with a given key and algorithm.
|
||||
*
|
||||
* @param string $msg The message to sign
|
||||
* @param string|resource $key The secret key
|
||||
* @param string $alg The signing algorithm.
|
||||
* Supported algorithms are 'HS256', 'HS384', 'HS512' and 'RS256'
|
||||
*
|
||||
* @return string An encrypted message
|
||||
*
|
||||
* @throws DomainException Unsupported algorithm was specified
|
||||
*/
|
||||
public static function sign($msg, $key, $alg = 'HS256')
|
||||
{
|
||||
if (empty(static::$supported_algs[$alg])) {
|
||||
throw new DomainException('Algorithm not supported');
|
||||
}
|
||||
list($function, $algorithm) = static::$supported_algs[$alg];
|
||||
switch($function) {
|
||||
case 'hash_hmac':
|
||||
return hash_hmac($algorithm, $msg, $key, true);
|
||||
case 'openssl':
|
||||
$signature = '';
|
||||
$success = openssl_sign($msg, $signature, $key, $algorithm);
|
||||
if (!$success) {
|
||||
throw new DomainException("OpenSSL unable to sign data");
|
||||
} else {
|
||||
return $signature;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Verify a signature with the message, key and method. Not all methods
|
||||
* are symmetric, so we must have a separate verify and sign method.
|
||||
*
|
||||
* @param string $msg The original message (header and body)
|
||||
* @param string $signature The original signature
|
||||
* @param string|resource $key For HS*, a string key works. for RS*, must be a resource of an openssl public key
|
||||
* @param string $alg The algorithm
|
||||
*
|
||||
* @return bool
|
||||
*
|
||||
* @throws DomainException Invalid Algorithm or OpenSSL failure
|
||||
*/
|
||||
private static function verify($msg, $signature, $key, $alg)
|
||||
{
|
||||
if (empty(static::$supported_algs[$alg])) {
|
||||
throw new DomainException('Algorithm not supported');
|
||||
}
|
||||
|
||||
list($function, $algorithm) = static::$supported_algs[$alg];
|
||||
switch($function) {
|
||||
case 'openssl':
|
||||
$success = openssl_verify($msg, $signature, $key, $algorithm);
|
||||
if ($success === 1) {
|
||||
return true;
|
||||
} elseif ($success === 0) {
|
||||
return false;
|
||||
}
|
||||
// returns 1 on success, 0 on failure, -1 on error.
|
||||
throw new DomainException(
|
||||
'OpenSSL error: ' . openssl_error_string()
|
||||
);
|
||||
case 'hash_hmac':
|
||||
default:
|
||||
$hash = hash_hmac($algorithm, $msg, $key, true);
|
||||
if (function_exists('hash_equals')) {
|
||||
return hash_equals($signature, $hash);
|
||||
}
|
||||
$len = min(static::safeStrlen($signature), static::safeStrlen($hash));
|
||||
|
||||
$status = 0;
|
||||
for ($i = 0; $i < $len; $i++) {
|
||||
$status |= (ord($signature[$i]) ^ ord($hash[$i]));
|
||||
}
|
||||
$status |= (static::safeStrlen($signature) ^ static::safeStrlen($hash));
|
||||
|
||||
return ($status === 0);
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Decode a JSON string into a PHP object.
|
||||
*
|
||||
* @param string $input JSON string
|
||||
*
|
||||
* @return object Object representation of JSON string
|
||||
*
|
||||
* @throws DomainException Provided string was invalid JSON
|
||||
*/
|
||||
public static function jsonDecode($input)
|
||||
{
|
||||
if (version_compare(PHP_VERSION, '5.4.0', '>=') && !(defined('JSON_C_VERSION') && PHP_INT_SIZE > 4)) {
|
||||
/** In PHP >=5.4.0, json_decode() accepts an options parameter, that allows you
|
||||
* to specify that large ints (like Steam Transaction IDs) should be treated as
|
||||
* strings, rather than the PHP default behaviour of converting them to floats.
|
||||
*/
|
||||
$obj = json_decode($input, false, 512, JSON_BIGINT_AS_STRING);
|
||||
} else {
|
||||
/** Not all servers will support that, however, so for older versions we must
|
||||
* manually detect large ints in the JSON string and quote them (thus converting
|
||||
*them to strings) before decoding, hence the preg_replace() call.
|
||||
*/
|
||||
$max_int_length = strlen((string) PHP_INT_MAX) - 1;
|
||||
$json_without_bigints = preg_replace('/:\s*(-?\d{'.$max_int_length.',})/', ': "$1"', $input);
|
||||
$obj = json_decode($json_without_bigints);
|
||||
}
|
||||
|
||||
if (function_exists('json_last_error') && $errno = json_last_error()) {
|
||||
static::handleJsonError($errno);
|
||||
} elseif ($obj === null && $input !== 'null') {
|
||||
throw new DomainException('Null result with non-null input');
|
||||
}
|
||||
return $obj;
|
||||
}
|
||||
|
||||
/**
|
||||
* Encode a PHP object into a JSON string.
|
||||
*
|
||||
* @param object|array $input A PHP object or array
|
||||
*
|
||||
* @return string JSON representation of the PHP object or array
|
||||
*
|
||||
* @throws DomainException Provided object could not be encoded to valid JSON
|
||||
*/
|
||||
public static function jsonEncode($input)
|
||||
{
|
||||
$json = json_encode($input);
|
||||
if (function_exists('json_last_error') && $errno = json_last_error()) {
|
||||
static::handleJsonError($errno);
|
||||
} elseif ($json === 'null' && $input !== null) {
|
||||
throw new DomainException('Null result with non-null input');
|
||||
}
|
||||
return $json;
|
||||
}
|
||||
|
||||
/**
|
||||
* Decode a string with URL-safe Base64.
|
||||
*
|
||||
* @param string $input A Base64 encoded string
|
||||
*
|
||||
* @return string A decoded string
|
||||
*/
|
||||
public static function urlsafeB64Decode($input)
|
||||
{
|
||||
$remainder = strlen($input) % 4;
|
||||
if ($remainder) {
|
||||
$padlen = 4 - $remainder;
|
||||
$input .= str_repeat('=', $padlen);
|
||||
}
|
||||
return base64_decode(strtr($input, '-_', '+/'));
|
||||
}
|
||||
|
||||
/**
|
||||
* Encode a string with URL-safe Base64.
|
||||
*
|
||||
* @param string $input The string you want encoded
|
||||
*
|
||||
* @return string The base64 encode of what you passed in
|
||||
*/
|
||||
public static function urlsafeB64Encode($input)
|
||||
{
|
||||
return str_replace('=', '', strtr(base64_encode($input), '+/', '-_'));
|
||||
}
|
||||
|
||||
/**
|
||||
* Helper method to create a JSON error.
|
||||
*
|
||||
* @param int $errno An error number from json_last_error()
|
||||
*
|
||||
* @return void
|
||||
*/
|
||||
private static function handleJsonError($errno)
|
||||
{
|
||||
$messages = array(
|
||||
JSON_ERROR_DEPTH => 'Maximum stack depth exceeded',
|
||||
JSON_ERROR_STATE_MISMATCH => 'Invalid or malformed JSON',
|
||||
JSON_ERROR_CTRL_CHAR => 'Unexpected control character found',
|
||||
JSON_ERROR_SYNTAX => 'Syntax error, malformed JSON',
|
||||
JSON_ERROR_UTF8 => 'Malformed UTF-8 characters' //PHP >= 5.3.3
|
||||
);
|
||||
throw new DomainException(
|
||||
isset($messages[$errno])
|
||||
? $messages[$errno]
|
||||
: 'Unknown JSON error: ' . $errno
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* Get the number of bytes in cryptographic strings.
|
||||
*
|
||||
* @param string
|
||||
*
|
||||
* @return int
|
||||
*/
|
||||
private static function safeStrlen($str)
|
||||
{
|
||||
if (function_exists('mb_strlen')) {
|
||||
return mb_strlen($str, '8bit');
|
||||
}
|
||||
return strlen($str);
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,7 @@
|
||||
<?php
|
||||
namespace Firebase\JWT;
|
||||
|
||||
class SignatureInvalidException extends \UnexpectedValueException
|
||||
{
|
||||
|
||||
}
|
||||
@@ -0,0 +1 @@
|
||||
<?php // Silence is golden
|
||||
@@ -0,0 +1,52 @@
|
||||
<?php
|
||||
|
||||
/**
|
||||
* The plugin bootstrap file.
|
||||
*
|
||||
* This file is read by WordPress to generate the plugin information in the plugin
|
||||
* admin area. This file also includes all of the dependencies used by the plugin,
|
||||
* registers the activation and deactivation functions, and defines a function
|
||||
* that starts the plugin.
|
||||
*
|
||||
* @link https://enriquechavez.co
|
||||
* @since 1.0.0
|
||||
*
|
||||
* @wordpress-plugin
|
||||
* Plugin Name: JWT Authentication for WP-API
|
||||
* Plugin URI: https://enriquechavez.co
|
||||
* Description: Extends the WP REST API using JSON Web Tokens Authentication as an authentication method.
|
||||
* Version: 1.2.4
|
||||
* Author: Enrique Chavez
|
||||
* Author URI: https://enriquechavez.co
|
||||
* License: GPL-2.0+
|
||||
* License URI: http://www.gnu.org/licenses/gpl-2.0.txt
|
||||
* Text Domain: jwt-auth
|
||||
* Domain Path: /languages
|
||||
*/
|
||||
|
||||
// If this file is called directly, abort.
|
||||
if (!defined('WPINC')) {
|
||||
die;
|
||||
}
|
||||
|
||||
/**
|
||||
* The core plugin class that is used to define internationalization,
|
||||
* admin-specific hooks, and public-facing site hooks.
|
||||
*/
|
||||
require plugin_dir_path(__FILE__) . 'includes/class-jwt-auth.php';
|
||||
|
||||
/**
|
||||
* Begins execution of the plugin.
|
||||
*
|
||||
* Since everything within the plugin is registered via hooks,
|
||||
* then kicking off the plugin from this point in the file does
|
||||
* not affect the page life cycle.
|
||||
*
|
||||
* @since 1.0.0
|
||||
*/
|
||||
function run_jwt_auth()
|
||||
{
|
||||
$plugin = new Jwt_Auth();
|
||||
$plugin->run();
|
||||
}
|
||||
run_jwt_auth();
|
||||
@@ -0,0 +1,335 @@
|
||||
<?php
|
||||
|
||||
/** Requiere the JWT library. */
|
||||
use \Firebase\JWT\JWT;
|
||||
|
||||
/**
|
||||
* The public-facing functionality of the plugin.
|
||||
*
|
||||
* @link https://enriquechavez.co
|
||||
* @since 1.0.0
|
||||
*/
|
||||
|
||||
/**
|
||||
* The public-facing functionality of the plugin.
|
||||
*
|
||||
* Defines the plugin name, version, and two examples hooks for how to
|
||||
* enqueue the admin-specific stylesheet and JavaScript.
|
||||
*
|
||||
* @author Enrique Chavez <noone@tmeister.net>
|
||||
*/
|
||||
class Jwt_Auth_Public
|
||||
{
|
||||
/**
|
||||
* The ID of this plugin.
|
||||
*
|
||||
* @since 1.0.0
|
||||
*
|
||||
* @var string The ID of this plugin.
|
||||
*/
|
||||
private $plugin_name;
|
||||
|
||||
/**
|
||||
* The version of this plugin.
|
||||
*
|
||||
* @since 1.0.0
|
||||
*
|
||||
* @var string The current version of this plugin.
|
||||
*/
|
||||
private $version;
|
||||
|
||||
/**
|
||||
* The namespace to add to the api calls.
|
||||
*
|
||||
* @var string The namespace to add to the api call
|
||||
*/
|
||||
private $namespace;
|
||||
|
||||
/**
|
||||
* Store errors to display if the JWT is wrong
|
||||
*
|
||||
* @var WP_Error
|
||||
*/
|
||||
private $jwt_error = null;
|
||||
|
||||
/**
|
||||
* Initialize the class and set its properties.
|
||||
*
|
||||
* @since 1.0.0
|
||||
*
|
||||
* @param string $plugin_name The name of the plugin.
|
||||
* @param string $version The version of this plugin.
|
||||
*/
|
||||
public function __construct($plugin_name, $version)
|
||||
{
|
||||
$this->plugin_name = $plugin_name;
|
||||
$this->version = $version;
|
||||
$this->namespace = $this->plugin_name.'/v'.intval($this->version);
|
||||
}
|
||||
|
||||
/**
|
||||
* Add the endpoints to the API
|
||||
*/
|
||||
public function add_api_routes()
|
||||
{
|
||||
register_rest_route($this->namespace, 'token', [
|
||||
'methods' => 'POST',
|
||||
'callback' => array($this, 'generate_token'),
|
||||
]);
|
||||
|
||||
register_rest_route($this->namespace, 'token/validate', array(
|
||||
'methods' => 'POST',
|
||||
'callback' => array($this, 'validate_token'),
|
||||
));
|
||||
}
|
||||
|
||||
/**
|
||||
* Add CORs suppot to the request.
|
||||
*/
|
||||
public function add_cors_support()
|
||||
{
|
||||
$enable_cors = defined('JWT_AUTH_CORS_ENABLE') ? JWT_AUTH_CORS_ENABLE : false;
|
||||
if ($enable_cors) {
|
||||
$headers = apply_filters('jwt_auth_cors_allow_headers', 'Access-Control-Allow-Headers, Content-Type, Authorization');
|
||||
header(sprintf('Access-Control-Allow-Headers: %s', $headers));
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Get the user and password in the request body and generate a JWT
|
||||
*
|
||||
* @param [type] $request [description]
|
||||
*
|
||||
* @return [type] [description]
|
||||
*/
|
||||
public function generate_token($request)
|
||||
{
|
||||
$secret_key = defined('JWT_AUTH_SECRET_KEY') ? JWT_AUTH_SECRET_KEY : false;
|
||||
$username = $request->get_param('username');
|
||||
$password = $request->get_param('password');
|
||||
|
||||
/** First thing, check the secret key if not exist return a error*/
|
||||
if (!$secret_key) {
|
||||
return new WP_Error(
|
||||
'jwt_auth_bad_config',
|
||||
__('JWT is not configurated properly, please contact the admin', 'wp-api-jwt-auth'),
|
||||
array(
|
||||
'status' => 403,
|
||||
)
|
||||
);
|
||||
}
|
||||
/** Try to authenticate the user with the passed credentials*/
|
||||
$user = wp_authenticate($username, $password);
|
||||
|
||||
/** If the authentication fails return a error*/
|
||||
if (is_wp_error($user)) {
|
||||
$error_code = $user->get_error_code();
|
||||
return new WP_Error(
|
||||
'[jwt_auth] '.$error_code,
|
||||
$user->get_error_message($error_code),
|
||||
array(
|
||||
'status' => 403,
|
||||
)
|
||||
);
|
||||
}
|
||||
|
||||
/** Valid credentials, the user exists create the according Token */
|
||||
$issuedAt = time();
|
||||
$notBefore = apply_filters('jwt_auth_not_before', $issuedAt, $issuedAt);
|
||||
$expire = apply_filters('jwt_auth_expire', $issuedAt + (DAY_IN_SECONDS * 7), $issuedAt);
|
||||
|
||||
$token = array(
|
||||
'iss' => get_bloginfo('url'),
|
||||
'iat' => $issuedAt,
|
||||
'nbf' => $notBefore,
|
||||
'exp' => $expire,
|
||||
'data' => array(
|
||||
'user' => array(
|
||||
'id' => $user->data->ID,
|
||||
),
|
||||
),
|
||||
);
|
||||
|
||||
/** Let the user modify the token data before the sign. */
|
||||
$token = JWT::encode(apply_filters('jwt_auth_token_before_sign', $token, $user), $secret_key);
|
||||
|
||||
/** The token is signed, now create the object with no sensible user data to the client*/
|
||||
$data = array(
|
||||
'token' => $token,
|
||||
'user_email' => $user->data->user_email,
|
||||
'user_nicename' => $user->data->user_nicename,
|
||||
'user_display_name' => $user->data->display_name,
|
||||
);
|
||||
|
||||
/** Let the user modify the data before send it back */
|
||||
return apply_filters('jwt_auth_token_before_dispatch', $data, $user);
|
||||
}
|
||||
|
||||
/**
|
||||
* This is our Middleware to try to authenticate the user according to the
|
||||
* token send.
|
||||
*
|
||||
* @param (int|bool) $user Logged User ID
|
||||
*
|
||||
* @return (int|bool)
|
||||
*/
|
||||
public function determine_current_user($user)
|
||||
{
|
||||
/**
|
||||
* This hook only should run on the REST API requests to determine
|
||||
* if the user in the Token (if any) is valid, for any other
|
||||
* normal call ex. wp-admin/.* return the user.
|
||||
*
|
||||
* @since 1.2.3
|
||||
**/
|
||||
$rest_api_slug = rest_get_url_prefix();
|
||||
$valid_api_uri = strpos($_SERVER['REQUEST_URI'], $rest_api_slug);
|
||||
if(!$valid_api_uri){
|
||||
return $user;
|
||||
}
|
||||
|
||||
/*
|
||||
* if the request URI is for validate the token don't do anything,
|
||||
* this avoid double calls to the validate_token function.
|
||||
*/
|
||||
$validate_uri = strpos($_SERVER['REQUEST_URI'], 'token/validate');
|
||||
if ($validate_uri > 0) {
|
||||
return $user;
|
||||
}
|
||||
|
||||
$token = $this->validate_token(false);
|
||||
|
||||
if (is_wp_error($token)) {
|
||||
if ($token->get_error_code() != 'jwt_auth_no_auth_header') {
|
||||
/** If there is a error, store it to show it after see rest_pre_dispatch */
|
||||
$this->jwt_error = $token;
|
||||
return $user;
|
||||
} else {
|
||||
return $user;
|
||||
}
|
||||
}
|
||||
/** Everything is ok, return the user ID stored in the token*/
|
||||
return $token->data->user->id;
|
||||
}
|
||||
|
||||
/**
|
||||
* Main validation function, this function try to get the Autentication
|
||||
* headers and decoded.
|
||||
*
|
||||
* @param bool $output
|
||||
*
|
||||
* @return WP_Error | Object | Array
|
||||
*/
|
||||
public function validate_token($output = true)
|
||||
{
|
||||
/*
|
||||
* Looking for the HTTP_AUTHORIZATION header, if not present just
|
||||
* return the user.
|
||||
*/
|
||||
$auth = isset($_SERVER['HTTP_AUTHORIZATION']) ? $_SERVER['HTTP_AUTHORIZATION'] : false;
|
||||
|
||||
|
||||
/* Double check for different auth header string (server dependent) */
|
||||
if (!$auth) {
|
||||
$auth = isset($_SERVER['REDIRECT_HTTP_AUTHORIZATION']) ? $_SERVER['REDIRECT_HTTP_AUTHORIZATION'] : false;
|
||||
}
|
||||
|
||||
if (!$auth) {
|
||||
return new WP_Error(
|
||||
'jwt_auth_no_auth_header',
|
||||
__('Authorization header not found.', 'wp-api-jwt-auth'),
|
||||
array(
|
||||
'status' => 403,
|
||||
)
|
||||
);
|
||||
}
|
||||
|
||||
/*
|
||||
* The HTTP_AUTHORIZATION is present verify the format
|
||||
* if the format is wrong return the user.
|
||||
*/
|
||||
list($token) = sscanf($auth, 'Bearer %s');
|
||||
if (!$token) {
|
||||
return new WP_Error(
|
||||
'jwt_auth_bad_auth_header',
|
||||
__('Authorization header malformed.', 'wp-api-jwt-auth'),
|
||||
array(
|
||||
'status' => 403,
|
||||
)
|
||||
);
|
||||
}
|
||||
|
||||
/** Get the Secret Key */
|
||||
$secret_key = defined('JWT_AUTH_SECRET_KEY') ? JWT_AUTH_SECRET_KEY : false;
|
||||
if (!$secret_key) {
|
||||
return new WP_Error(
|
||||
'jwt_auth_bad_config',
|
||||
__('JWT is not configurated properly, please contact the admin', 'wp-api-jwt-auth'),
|
||||
array(
|
||||
'status' => 403,
|
||||
)
|
||||
);
|
||||
}
|
||||
|
||||
/** Try to decode the token */
|
||||
try {
|
||||
$token = JWT::decode($token, $secret_key, array('HS256'));
|
||||
/** The Token is decoded now validate the iss */
|
||||
if ($token->iss != get_bloginfo('url')) {
|
||||
/** The iss do not match, return error */
|
||||
return new WP_Error(
|
||||
'jwt_auth_bad_iss',
|
||||
__('The iss do not match with this server', 'wp-api-jwt-auth'),
|
||||
array(
|
||||
'status' => 403,
|
||||
)
|
||||
);
|
||||
}
|
||||
/** So far so good, validate the user id in the token */
|
||||
if (!isset($token->data->user->id)) {
|
||||
/** No user id in the token, abort!! */
|
||||
return new WP_Error(
|
||||
'jwt_auth_bad_request',
|
||||
__('User ID not found in the token', 'wp-api-jwt-auth'),
|
||||
array(
|
||||
'status' => 403,
|
||||
)
|
||||
);
|
||||
}
|
||||
/** Everything looks good return the decoded token if the $output is false */
|
||||
if (!$output) {
|
||||
return $token;
|
||||
}
|
||||
/** If the output is true return an answer to the request to show it */
|
||||
return array(
|
||||
'code' => 'jwt_auth_valid_token',
|
||||
'data' => array(
|
||||
'status' => 200,
|
||||
),
|
||||
);
|
||||
} catch (Exception $e) {
|
||||
/** Something is wrong trying to decode the token, send back the error */
|
||||
return new WP_Error(
|
||||
'jwt_auth_invalid_token',
|
||||
$e->getMessage(),
|
||||
array(
|
||||
'status' => 403,
|
||||
)
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Filter to hook the rest_pre_dispatch, if the is an error in the request
|
||||
* send it, if there is no error just continue with the current request.
|
||||
*
|
||||
* @param $request
|
||||
*/
|
||||
public function rest_pre_dispatch($request)
|
||||
{
|
||||
if (is_wp_error($this->jwt_error)) {
|
||||
return $this->jwt_error;
|
||||
}
|
||||
return $request;
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1 @@
|
||||
<?php // Silence is golden
|
||||
@@ -0,0 +1,365 @@
|
||||
=== JWT Authentication for WP REST API ===
|
||||
|
||||
Contributors: tmeister
|
||||
Donate link: https://enriquechavez.co
|
||||
Tags: wp-json, jwt, json web authentication, wp-api
|
||||
Requires at least: 4.2
|
||||
Tested up to: 4.8.1
|
||||
Requires PHP: 5.3.0
|
||||
Stable tag: 1.2.4
|
||||
License: GPLv2 or later
|
||||
License URI: http://www.gnu.org/licenses/gpl-2.0.html
|
||||
|
||||
Extends the WP REST API using JSON Web Tokens Authentication as an authentication method.
|
||||
|
||||
== Description ==
|
||||
|
||||
Extends the WP REST API using JSON Web Tokens Authentication as an authentication method.
|
||||
|
||||
JSON Web Tokens are an open, industry standard [RFC 7519](https://tools.ietf.org/html/rfc7519) method for representing claims securely between two parties.
|
||||
|
||||
**Support and Requests please in Github:** https://github.com/Tmeister/wp-api-jwt-auth
|
||||
|
||||
### REQUIREMENTS
|
||||
|
||||
#### WP REST API V2
|
||||
|
||||
This plugin was conceived to extend the [WP REST API V2](https://github.com/WP-API/WP-API) plugin features and, of course, was built on top of it.
|
||||
|
||||
So, to use the **wp-api-jwt-auth** you need to install and activate [WP REST API](https://github.com/WP-API/WP-API).
|
||||
|
||||
### PHP
|
||||
|
||||
**Minimum PHP version: 5.3.0**
|
||||
|
||||
### PHP HTTP Authorization Header enable
|
||||
|
||||
Most of the shared hosting has disabled the **HTTP Authorization Header** by default.
|
||||
|
||||
To enable this option you'll need to edit your **.htaccess** file adding the follow
|
||||
|
||||
`
|
||||
RewriteEngine on
|
||||
RewriteCond %{HTTP:Authorization} ^(.*)
|
||||
RewriteRule ^(.*) - [E=HTTP_AUTHORIZATION:%1]
|
||||
`
|
||||
|
||||
#### WPENGINE
|
||||
|
||||
To enable this option you'll need to edit your **.htaccess** file adding the follow
|
||||
|
||||
See https://github.com/Tmeister/wp-api-jwt-auth/issues/1
|
||||
|
||||
`
|
||||
SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1
|
||||
`
|
||||
|
||||
### CONFIGURATION
|
||||
### Configurate the Secret Key
|
||||
|
||||
The JWT needs a **secret key** to sign the token this **secret key** must be unique and never revealed.
|
||||
|
||||
To add the **secret key** edit your wp-config.php file and add a new constant called **JWT_AUTH_SECRET_KEY**
|
||||
|
||||
`
|
||||
define('JWT_AUTH_SECRET_KEY', 'your-top-secrect-key');
|
||||
`
|
||||
|
||||
You can use a string from here https://api.wordpress.org/secret-key/1.1/salt/
|
||||
|
||||
### Configurate CORs Support
|
||||
|
||||
The **wp-api-jwt-auth** plugin has the option to activate [CORs](https://en.wikipedia.org/wiki/Cross-origin_resource_sharing) support.
|
||||
|
||||
To enable the CORs Support edit your wp-config.php file and add a new constant called **JWT_AUTH_CORS_ENABLE**
|
||||
|
||||
`
|
||||
define('JWT_AUTH_CORS_ENABLE', true);
|
||||
`
|
||||
|
||||
Finally activate the plugin within your wp-admin.
|
||||
|
||||
### Namespace and Endpoints
|
||||
|
||||
When the plugin is activated, a new namespace is added
|
||||
|
||||
`
|
||||
/jwt-auth/v1
|
||||
`
|
||||
|
||||
Also, two new endpoints are added to this namespace
|
||||
|
||||
Endpoint | HTTP Verb
|
||||
*/wp-json/jwt-auth/v1/token* | POST
|
||||
*/wp-json/jwt-auth/v1/token/validate* | POST
|
||||
|
||||
###USAGE
|
||||
### /wp-json/jwt-auth/v1/token
|
||||
|
||||
This is the entry point for the JWT Authentication.
|
||||
|
||||
Validates the user credentials, *username* and *password*, and returns a token to use in a future request to the API if the authentication is correct or error if the authentication fails.
|
||||
|
||||
####Sample request using AngularJS
|
||||
|
||||
( function() {
|
||||
|
||||
var app = angular.module( 'jwtAuth', [] );
|
||||
|
||||
app.controller( 'MainController', function( $scope, $http ) {
|
||||
|
||||
var apiHost = 'http://yourdomain.com/wp-json';
|
||||
|
||||
$http.post( apiHost + '/jwt-auth/v1/token', {
|
||||
username: 'admin',
|
||||
password: 'password'
|
||||
} )
|
||||
|
||||
.then( function( response ) {
|
||||
console.log( response.data )
|
||||
} )
|
||||
|
||||
.catch( function( error ) {
|
||||
console.error( 'Error', error.data[0] );
|
||||
} );
|
||||
|
||||
} );
|
||||
|
||||
} )();
|
||||
|
||||
|
||||
|
||||
Success response from the server
|
||||
|
||||
`
|
||||
{
|
||||
"token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJodHRwOlwvXC9qd3QuZGV2IiwiaWF0IjoxNDM4NTcxMDUwLCJuYmYiOjE0Mzg1NzEwNTAsImV4cCI6MTQzOTE3NTg1MCwiZGF0YSI6eyJ1c2VyIjp7ImlkIjoiMSJ9fX0.YNe6AyWW4B7ZwfFE5wJ0O6qQ8QFcYizimDmBy6hCH_8",
|
||||
"user_display_name": "admin",
|
||||
"user_email": "admin@localhost.dev",
|
||||
"user_nicename": "admin"
|
||||
}
|
||||
`
|
||||
|
||||
Error response from the server
|
||||
|
||||
`
|
||||
{
|
||||
"code": "jwt_auth_failed",
|
||||
"data": {
|
||||
"status": 403
|
||||
},
|
||||
"message": "Invalid Credentials."
|
||||
}
|
||||
`
|
||||
|
||||
Once you get the token, you must store it somewhere in your application, ex. in a **cookie** or using **localstorage**.
|
||||
|
||||
From this point, you should pass this token to every API call
|
||||
|
||||
Sample call using the Authorization header using AngularJS
|
||||
|
||||
`
|
||||
app.config( function( $httpProvider ) {
|
||||
$httpProvider.interceptors.push( [ '$q', '$location', '$cookies', function( $q, $location, $cookies ) {
|
||||
return {
|
||||
'request': function( config ) {
|
||||
config.headers = config.headers || {};
|
||||
//Assume that you store the token in a cookie.
|
||||
var globals = $cookies.getObject( 'globals' ) || {};
|
||||
//If the cookie has the CurrentUser and the token
|
||||
//add the Authorization header in each request
|
||||
if ( globals.currentUser && globals.currentUser.token ) {
|
||||
config.headers.Authorization = 'Bearer ' + globals.currentUser.token;
|
||||
}
|
||||
return config;
|
||||
}
|
||||
};
|
||||
} ] );
|
||||
} );
|
||||
`
|
||||
|
||||
The **wp-api-jwt-auth** will intercept every call to the server and will look for the Authorization Header, if the Authorization header is present will try to decode the token and will set the user according with the data stored in it.
|
||||
|
||||
If the token is valid, the API call flow will continue as always.
|
||||
|
||||
**Sample Headers**
|
||||
|
||||
`
|
||||
POST /resource HTTP/1.1
|
||||
Host: server.example.com
|
||||
Authorization: Bearer mF_s9.B5f-4.1JqM
|
||||
`
|
||||
|
||||
###ERRORS
|
||||
|
||||
If the token is invalid an error will be returned, here are some samples of errors.
|
||||
|
||||
**Invalid Credentials**
|
||||
|
||||
`
|
||||
[
|
||||
{
|
||||
"code": "jwt_auth_failed",
|
||||
"message": "Invalid Credentials.",
|
||||
"data": {
|
||||
"status": 403
|
||||
}
|
||||
}
|
||||
]
|
||||
`
|
||||
|
||||
**Invalid Signature**
|
||||
|
||||
`
|
||||
[
|
||||
{
|
||||
"code": "jwt_auth_invalid_token",
|
||||
"message": "Signature verification failed",
|
||||
"data": {
|
||||
"status": 403
|
||||
}
|
||||
}
|
||||
]
|
||||
`
|
||||
|
||||
**Expired Token**
|
||||
|
||||
`
|
||||
[
|
||||
{
|
||||
"code": "jwt_auth_invalid_token",
|
||||
"message": "Expired token",
|
||||
"data": {
|
||||
"status": 403
|
||||
}
|
||||
}
|
||||
]
|
||||
`
|
||||
|
||||
### /wp-json/jwt-auth/v1/token/validate
|
||||
|
||||
This is a simple helper endpoint to validate a token; you only will need to make a POST request sending the Authorization header.
|
||||
|
||||
Valid Token Response
|
||||
|
||||
`
|
||||
{
|
||||
"code": "jwt_auth_valid_token",
|
||||
"data": {
|
||||
"status": 200
|
||||
}
|
||||
}
|
||||
`
|
||||
|
||||
###AVAILABLE HOOKS
|
||||
|
||||
The **wp-api-jwt-auth** is dev friendly and has five filters available to override the default settings.
|
||||
|
||||
####jwt_auth_cors_allow_headers
|
||||
|
||||
The **jwt_auth_cors_allow_headers** allows you to modify the available headers when the CORs support is enabled.
|
||||
|
||||
Default Value:
|
||||
|
||||
`
|
||||
'Access-Control-Allow-Headers, Content-Type, Authorization'
|
||||
`
|
||||
|
||||
###jwt_auth_not_before
|
||||
|
||||
The **jwt_auth_not_before** allows you to change the [**nbf**](https://tools.ietf.org/html/rfc7519#section-4.1.5) value before the token is created.
|
||||
|
||||
Default Value:
|
||||
|
||||
`
|
||||
Creation time - time()
|
||||
`
|
||||
|
||||
###jwt_auth_expire
|
||||
|
||||
The **jwt_auth_expire** allows you to change the value [**exp**](https://tools.ietf.org/html/rfc7519#section-4.1.4) before the token is created.
|
||||
|
||||
Default Value:
|
||||
|
||||
`
|
||||
time() + (DAY_IN_SECONDS * 7)
|
||||
`
|
||||
|
||||
###jwt_auth_token_before_sign
|
||||
|
||||
The **jwt_auth_token_before_sign** allows you to modify all the token data before to be encoded and signed.
|
||||
|
||||
Default Value
|
||||
|
||||
`
|
||||
<?php
|
||||
$token = array(
|
||||
'iss' => get_bloginfo('url'),
|
||||
'iat' => $issuedAt,
|
||||
'nbf' => $notBefore,
|
||||
'exp' => $expire,
|
||||
'data' => array(
|
||||
'user' => array(
|
||||
'id' => $user->data->ID,
|
||||
)
|
||||
)
|
||||
);
|
||||
`
|
||||
|
||||
###jwt_auth_token_before_dispatch
|
||||
The **jwt_auth_token_before_dispatch** allows you to modify all the response array before to dispatch it to the client.
|
||||
|
||||
Default Value:
|
||||
|
||||
`
|
||||
<?php
|
||||
$data = array(
|
||||
'token' => $token,
|
||||
'user_email' => $user->data->user_email,
|
||||
'user_nicename' => $user->data->user_nicename,
|
||||
'user_display_name' => $user->data->display_name,
|
||||
);
|
||||
`
|
||||
|
||||
==Installation==
|
||||
|
||||
= Using The WordPress Dashboard =
|
||||
|
||||
1. Navigate to the 'Add New' in the plugins dashboard
|
||||
2. Search for 'jwt-authentication-for-wp-rest-api'
|
||||
3. Click 'Install Now'
|
||||
4. Activate the plugin on the Plugin dashboard
|
||||
|
||||
= Uploading in WordPress Dashboard =
|
||||
|
||||
1. Navigate to the 'Add New' in the plugins dashboard
|
||||
2. Navigate to the 'Upload' area
|
||||
3. Select `jwt-authentication-for-wp-rest-api.zip` from your computer
|
||||
4. Click 'Install Now'
|
||||
5. Activate the plugin in the Plugin dashboard
|
||||
|
||||
###Please read how to configured the plugin https://wordpress.org/plugins/jwt-authentication-for-wp-rest-api/
|
||||
|
||||
== Changelog ==
|
||||
= 1.2.4 =
|
||||
* Update firebase/php-jwt to v5.0.0 ( https://github.com/firebase/php-jwt )
|
||||
* Add Requires PHP Tag
|
||||
|
||||
= 1.2.3 =
|
||||
* Fix Max recursion error in WordPress 4.7 #44
|
||||
|
||||
= 1.2.2 =
|
||||
* Add an extra validation to get the Authorization header
|
||||
* Increase determine_current_user priority Fix #13
|
||||
* Add the user object as parameter in the jwt_auth_token_before_sign hook
|
||||
* Improve error message when auth fails #34
|
||||
* Tested with 4.6.1
|
||||
|
||||
= 1.2.0 =
|
||||
* Tested with 4.4.2
|
||||
|
||||
= 1.0.0 =
|
||||
* Initial Release.
|
||||
|
||||
== Upgrade Notice ==
|
||||
.
|
||||
@@ -0,0 +1,155 @@
|
||||
<?php
|
||||
|
||||
class GeneralTest extends PHPUnit_Framework_TestCase
|
||||
{
|
||||
protected $baseUrl = 'http://jwt.dev/';
|
||||
protected $client;
|
||||
|
||||
protected function setUp()
|
||||
{
|
||||
$this->client = new GuzzleHttp\Client([
|
||||
'base_uri' => $this->baseUrl
|
||||
]);
|
||||
}
|
||||
|
||||
/**
|
||||
* Load the site and look for a Status Code Equal to 200
|
||||
*/
|
||||
public function test_is_site_up()
|
||||
{
|
||||
$response = $this->client->get('/');
|
||||
$this->assertEquals(200, $response->getStatusCode());
|
||||
}
|
||||
|
||||
/**
|
||||
* Look for the wp-json endpoint and look for basic data.
|
||||
*/
|
||||
public function test_is_wp_api_installed()
|
||||
{
|
||||
$response = $this->client->get('wp-json/');
|
||||
$this->assertEquals(200, $response->getStatusCode());
|
||||
$data = json_decode($response->getBody(), true);
|
||||
$this->assertArrayHasKey('namespaces', $data);
|
||||
$this->assertArrayHasKey('authentication', $data);
|
||||
$this->assertArrayHasKey('routes', $data);
|
||||
}
|
||||
|
||||
/**
|
||||
* Check for the jwt-auth/v1 endpoint and
|
||||
*/
|
||||
public function test_is_jwt_installed()
|
||||
{
|
||||
$response = $this->client->get('wp-json/jwt-auth/v1/');
|
||||
$this->assertEquals(200, $response->getStatusCode());
|
||||
$data = json_decode($response->getBody(), true);
|
||||
$this->assertEquals('jwt-auth/v1', $data['namespace']);
|
||||
}
|
||||
|
||||
/**
|
||||
* Get the user token
|
||||
*/
|
||||
public function test_get_jwt_token()
|
||||
{
|
||||
$response = $this->client->post('wp-json/jwt-auth/v1/token', [
|
||||
'json' => [
|
||||
'username' => 'admin',
|
||||
'password' => 'poipoipoi'
|
||||
]
|
||||
]);
|
||||
$this->assertEquals(200, $response->getStatusCode());
|
||||
$data = json_decode($response->getBody(), true);
|
||||
$this->assertArrayHasKey('token', $data);
|
||||
$this->assertArrayHasKey('token', $data);
|
||||
$this->assertArrayHasKey('user_email', $data);
|
||||
$this->assertNotEmpty($data['token']);
|
||||
$this->assertNotEmpty($data['user_email']);
|
||||
}
|
||||
|
||||
/**
|
||||
* Get the Token and then validate...
|
||||
*/
|
||||
public function test_validate_jwt_token()
|
||||
{
|
||||
$token = '';
|
||||
#first get a valid token.
|
||||
$response = $this->client->post('wp-json/jwt-auth/v1/token', [
|
||||
'json' => [
|
||||
'username' => 'admin',
|
||||
'password' => 'poipoipoi'
|
||||
]
|
||||
]);
|
||||
$this->assertEquals(200, $response->getStatusCode());
|
||||
$data = json_decode($response->getBody(), true);
|
||||
$token = $data['token'];
|
||||
|
||||
#With the token now validate it.
|
||||
$response = $this->client->post('wp-json/jwt-auth/v1/token/validate', [
|
||||
'headers' => [
|
||||
'Authorization' => 'Bearer ' . $token
|
||||
]
|
||||
]);
|
||||
$this->assertEquals(200, $response->getStatusCode());
|
||||
$data = json_decode($response->getBody(), true);
|
||||
$this->assertArrayHasKey('code', $data);
|
||||
$this->assertArrayHasKey('data', $data);
|
||||
$this->assertEquals(200, $data['data']['status']);
|
||||
|
||||
#Finally get the me | Reading
|
||||
$response = $this->client->get('wp-json/wp/v2/users/me', [
|
||||
'headers' => [
|
||||
'Authorization' => 'Bearer ' . $token
|
||||
]
|
||||
]);
|
||||
|
||||
$this->assertEquals(200, $response->getStatusCode());
|
||||
$data = json_decode($response->getBody(), true);
|
||||
$this->assertArrayHasKey('id', $data);
|
||||
$this->assertArrayHasKey('name', $data);
|
||||
}
|
||||
|
||||
/**
|
||||
* Try to Write a Post | Write Permissions
|
||||
*/
|
||||
public function test_jwt_write_access()
|
||||
{
|
||||
#first get a valid token.
|
||||
$response = $this->client->post('wp-json/jwt-auth/v1/token', [
|
||||
'json' => [
|
||||
'username' => 'admin',
|
||||
'password' => 'poipoipoi'
|
||||
]
|
||||
]);
|
||||
$this->assertEquals(200, $response->getStatusCode());
|
||||
$data = json_decode($response->getBody(), true);
|
||||
$token = $data['token'];
|
||||
|
||||
#Create the post | Writing
|
||||
$response = $this->client->post('wp-json/wp/v2/posts', [
|
||||
'headers' => [
|
||||
'Authorization' => 'Bearer ' . $token
|
||||
],
|
||||
'json' => [
|
||||
'title' => 'Created from Tests'
|
||||
]
|
||||
]);
|
||||
|
||||
$this->assertEquals(201, $response->getStatusCode());
|
||||
$data = json_decode($response->getBody(), true);
|
||||
#201 is created and now look and get the new post ID
|
||||
$this->assertArrayHasKey('id', $data);
|
||||
$post_id = $data['id'];
|
||||
|
||||
#Delete the test post
|
||||
#Finally get the me | Reading
|
||||
$response = $this->client->delete('wp-json/wp/v2/posts/' . $post_id, [
|
||||
'headers' => [
|
||||
'Authorization' => 'Bearer ' . $token
|
||||
]
|
||||
]);
|
||||
$this->assertEquals(200, $response->getStatusCode());
|
||||
$data = json_decode($response->getBody(), true);
|
||||
$this->assertArrayHasKey('id', $data);
|
||||
//The post ID must to be the same as the created one.
|
||||
$this->assertEquals($post_id, $data['id']);
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user