How to use JWT in Yii2 project?

Question

In my REST API i want to use JWT fro Authorization.

So, I include this extension - https://github.com/sizeg/yii2-jwt

It clear how to create JWT token, but how to validate Token in API side ? I heart, i must use two tokens - auth_token and refresh_token. For what? What different when i whatt to validate and check user ?

I mean - ok, when i receive username and password, I create auth_token (JWT) and update token in users DB, after i return token to frontend.

After frontend will send auth token in each request, and I will validate token and check user in users DB and check access etc. How to realize refresh token and for what?

For example my controller:

class UploadController extends Controller {

    public $serializer = [
        'class' => 'yii\rest\Serializer',
        'collectionEnvelope' => 'items',
    ];

    public function behaviors()
    {
        $behaviors = parent::behaviors();

        $behaviors['authenticator'] = [
            'class' => JwtHttpBearerAuth::className()
        ];

        return $behaviors;
    }

    public function actionIndex() {

       //Work with User
    }
}

And how to get token from headers ?

Answer 1

Controller

public function actionLogin()
{

    $username = Yii::$app->request->post('username');
    $password = Yii::$app->request->post('password');

    $provider = new ActiveDataProvider([
        'query' => User::find()
                ->where(['user_name' => $username])->asArray()->one(),
    ]);

    $result = $provider->query;

    if($result)
    {
        if (Yii::$app->getSecurity()->validatePassword($password, $result['user_pass'])) 
        {
            $tokenId    = base64_encode(mcrypt_create_iv(32));
            $issuedAt   = time();
            $notBefore  = $issuedAt;             //Adding 10 seconds
            $expire     = $notBefore + 5184000;            // Adding 60 Days
            $serverName = 'your-site.com';
            $data = [
                'iat'  => $issuedAt,         // Issued at: time when the token was generated
                'jti'  => $tokenId,          // Json Token Id: an unique identifier for the token
                'iss'  => $serverName,       // Issuer
                'nbf'  => $notBefore,        // Not before
                'exp'  => $expire,           // Expire
                'data' => [                  // Data related to the signer user
                    'id' => $result['user_id'],
                    'username' => $result['user_name'],
                    'mobile' => $result['user_mobile'],
                    'email' => $result['user_email'],
                    'city' => $result['user_city'],
                    'state' => $result['user_state'],
                    'country' => $result['user_country'],
                    'picture' => $result['user_picture'],
                ]
            ];

            $jwt = JWT::encode(
                $data,     
                JWT_KEY, 
                'HS512'  
            );

            $response = [
                'status' => true,
                'message' => 'Login Success..',
                'era_tkn' => $jwt,
            ];
        } 
        else 
        {
            $response = [
                'status' => false,
                'message' => 'Wrong username or password.',
            ];
        }
    }
    else
    {
        $response = [
            'status' => false,
            'message' => 'Wrong username or password.',
        ];
    }

    return $response;
}

Make global method for check token

public function check_token()
{
    $headers = Yii::$app->request->headers;
    $token = $headers->get('era_tkn');
    if($token)
    {
        try{
        $valid_data = JWT::decode($token, JWT_KEY, array('HS512'));
        $valid_data = $valid_data->data;

        }catch(Exception $e){
            $valid_data = $e->getMessage();
        }
    }
    else
    {
        $valid_data = 'Required Authentication';
    }

    return $valid_data;
}

Call check_token mathod

$user_data = $this->check_token();
    if (!empty($user_data->id))
    {
        echo $user_data->id;
    }
    else
    {
       echo "Invalid Token.";
    }