Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Laravel 5.2 token based authentication vs JWT

I implement authentication for my API service and consider Laravel 5.2 token-based authentication for this. Is there any reasons to use Json Web Tokens instead? Is it actually comparable? I found tymondesigns/jwt-auth package and some tutorials about it. But since Laravel 5.2 supports token authentication natively what is the purpose of this package?

like image 383
Phargelm Avatar asked May 24 '16 11:05

Phargelm


People also ask

Which is better JWT or Passport in laravel?

JSON Web Token and Passport can be primarily classified as "User Management and Authentication" tools. JSON Web Token and Passport are both open source tools. It seems that Passport with 15.9K GitHub stars and 936 forks on GitHub has more adoption than JSON Web Token with 2.59K GitHub stars and 259 GitHub forks.

Does laravel use JWT?

Laravel JWT authentication vs.Passport uses JWT authentication as standard but also implements full OAuth 2.0 authorization. OAuth allows authorization from third-party applications like Google, GitHub, and Facebook, but not every app requires this feature.

What is difference between Passport and JWT token in laravel?

JWT - is a simple JSON Web Token, it simply gives a token to the user that can be used to login, this token will never expire (Passport tokens will expire and the client will need to update the token with the refresh token)

Is JWT token-based authentication?

JWT authentication is a token-based stateless authentication mechanism. It is popularly used as a client-side-based stateless session, this means the server doesn't have to completely rely on a data store (or) database to save session information. JWTs can be encrypted, but they are typically encoded & signed.


1 Answers

Laravel 5.2 ships with token-based authentication that checks all requests made, look for the token, and validates them against a custom token column in the users table. That's all there is to it.

The JWT-auth package has more to it:

  • You can specify a secret key that signs your client tokens with a hashing algorithm, in the similiar way that Laravel hashes passwords so they are not readable if someone might access your database.
  • You may set a TTL (time to live) and refresh TTL value for how long a token should be valid.
  • You get Providers and Facades to help you manage the authentication logic when implementing your service.
  • Also: A JWT token consists of 3 parts, (header, body, signature). These parts can hold information about eg. user claims/permissions/whatever. The laravel token is just a random string and it self holds no further information at all.
like image 109
henrik Avatar answered Oct 22 '22 01:10

henrik