I am using laravel passport with password grant mode , i found it generated access token is very long , like this :
{
"token_type": "Bearer",
"expires_in": 31536000,
"access_token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImp0aSI6IjRmOTlkNDI2ZmIxN2I5OGVmNzExYzMyOGQ2YzMwODBhOGY4OGVjYWI4Yjg3Zjg2MmFkNWFlNGI5MzdiYjg0MGQ3MDk2NWI2OWY4NDk3MTE0In0.eyJhdWQiOiIyIiwianRpIjoiNGY5OWQ0MjZmYjE3Yjk4ZWY3MTFjMzI4ZDZjMzA4MGE4Zjg4ZWNhYjhiODdmODYyYWQ1YWU0YjkzN2JiODQwZDcwOTY1YjY5Zjg0OTcxMTQiLCJpYXQiOjE0ODk0NDAzODEsIm5iZiI6MTQ4OTQ0MDM4MSwiZXhwIjoxNTIwOTc2MzgxLCJzdWIiOiIyIiwic2NvcGVzIjpbXX0.XEY0vMoUt6Z9cWMkELQhfcaC2uab8odQLmIVTh8YWULSYOPuw4vpTDFurgU2vflM8-5PYuIIOnw8-8CQVZvetkYLpp2r0GqdNPIcCwlZNh9zRFLLigJ1vm4GKsbGozoDieR9FBpvQ2K9gFM0V4kwjSwx74fdlC1imC1rZ8qRYy5e1zctrMSrVcGcT5F4PTm4DdTN50IRcsOIJK9T6Wgec-iYmey0-xKg0UQroCF6rZUtC0VlH8XwhW_1QfrCl7dkKIcEbWi4pgzDpwrLMZgLAQpPktCP2G9SujC99e7M_L3C8Y647enwUQSTKtp6xNyTyyHSqS0NAxU4U0TFTICMPH5D_L_WaTeBCLS3MdwM3cmTQdkjdXjljjurHld3yEvVemo7oAr2Wb_HOC1uFET0ndeVGI1ZhgM-AuUBy1dJrV4a0iyUIiVtO12LadFIK2m9h0YQlawN1me_HQy6FxdBQuMJ3WIuR3Mwp79RHkoYKFQGvfxTTK8N0emZzmLl5rODp6n7I1UKDb_g7weHdmFP2paTJCApikIXidYA-QXa1i2qMfCwB7gF_kqBvrOyL29wFFRBc_ACRA-0I8iEhZ18vF7htKkPgWoYyPzBKHjVJ4vrxV_VxbGcszIC5byAJKcmpcXEOnFXkFV7NF-tOb___hw9THTjYQmznM1OS__U8zA",
"refresh_token": "RXFyjx21XaLKgkOXa5zZyVbhRqXDsRZbfsFZmxst4Un0+VWtl0xTn/jIOPzApdqFFoTBCH08Ytjxf6SlcEOIUuHhN5+V7wuun/nFCuKIoC2T1xg9Ny2KkzRq0IF+bSBgtZ5QXfu+ILkCSZ/uh39rRxpoO4aqcnJp2Bvj5wuVcFra2nnPCu/Rfs+AN7MA5H8WgzfLmsIFsh3/rtzU4KboFR0rQE4MrDecrJCmCjvAJS52LLdFhDnNi/KdjhxBXY7jpgXZF+HOLAribGPn9COoC7B9zGoYHA3zaOMopsJ+NaRTHsuf2VbXlrQ4eXME5XVB4+TpgU8LGipK1jv5Ndhfu/VJaxgRk94VEuAcYu4vWUEdNl5Y4sRPDSlIpwjnXxdiiAUuNnvbrUaRD/qStJmmzQiWe7M07qVTHp4PNrVOVhjZkIsFMWoMsRHWtDu0eRbde3tBOhIWUCwxndp9Ma9DlSwuq6jmhv/mi62QboYjgZrWJAqLSIeP13mRyH0kNR4LCauCpiXgaPPTywBBfYpEIn34DQeo9QQfvnnut9ky8hRgniQjhGbvgeyIOS7WgmDR0Wmbt0jwLY5MWl5WuyhAJztQPnt0sTLxWzey0ZCRC5DWMSzt/g8cTL7cfjCxPYYdLCsAYE6eXTEaA3zZLre2GnBJwwE0+3bIRctQDH9zYRE="
}
I know a long token will be safer, but over one thousand characters seems a bit scary. In my impression, JWT is commonly very small, but here, this generated token is so long, so big .
I want to generate a shorter token , what is good way to do it?
If laravel passport is able to specify lenght of token?
Requesting Tokens Once you have created a password grant client, you may request an access token by issuing a POST request to the /oauth/token route with the user's email address and password. Remember, this route is already registered by the Passport::routes method so there is no need to define it manually.
Laravel JWT authentication vs. Sanctum offers both session-based and token-based authentication and is good for single-page application (SPA) authentications. Passport uses JWT authentication as standard but also implements full OAuth 2.0 authorization.
The "tymondesigns/jwt-auth" is a PHP Laravel implementation of the JWT protocol. On the other hand, Passport also uses JWT by default plus a huge extra, a complete Oauth2 implementation. Regarding the functionality, as I said they both use JWT thus you can use whichever you like to authentication via tokens.
we can increase token expire time of access token using tokensExpireIn() in laravel 6, laravel 7, laravel 8 and laravel 9 app. we can increase refresh token expire time of access token using refreshTokensExpireIn(). we can increase personal access token expire time of access token using personalAccessTokensExpireIn().
If you feel need to shorten the token length, maybe you should regenerate the key pair files with this command:
php artisan passport:keys --length=512 --force
The length of the JWT depends on 2 things: your payload size and the encryption algorithm used. Laravel appears to be using public/private key hashing (RS256) for their JWTs, which requires longer key lengths than say using HS256 algorithm. You can see it if you go to https://jwt.io/ and paste in your token.
If you want to use Laravel Passport then there is no easy way around this length requirement. You can either create libs with methods that override the Passport method used to set the hashing algorithm (not recommended that you go down this rabbit hole), or you can just not use Passport and instead implement your own JWT token authentication system, or you can just live with the long tokens.
Using Passport version less than "^7.0.0"
the JTI (id of token saved in oauth_access_tokens
table) is in the header as well as in the body of the JWT. Upgrading to version "^8.0.0"
can reduce the JWT token with another 100 bytes or so because they removed the JTI from the header.
So combining the upgrade to version 8 and the answer by Sreng-s, my JWT is down to 340 bytes. It's better than the 1070 bytes I started out with but it's still really big considering it's being sent with every request.
Any further improvements would be very much appreciated.
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With