JWT

JWT

This document covers the OpenTHC's JWT wrapper using the Firebase PHP-JWT library.

Minting JWTs

A authenticated user session may mint a JWT in an Application Environment (APP) for authorized HTTP requests against an external service environment (EXT) when:

1. APP has configuration:

etc/config.php

// @bug found uses of 'application' and 'app'
'application' => [
	'id' => 'EXAMPLE_ID',
	'secret' => 'example.openthc.com-secret',
]

2. EXT is has configuration for APP in:

etc/config.php

'openthc' => [

	'app' => [
		'id' => 'EXAMPLE_ID',
		'hostname' => 'app.openthc.dev',
		'secret' => 'app.openthc.dev-secret',
	],

]

Usage

use OpenTHC\JWT;

$claims = JWT::base_claims();
$payload = array_merge($claims, [
	'Company' => [
		'id' => '01EXMSAJAF1M2KKJWWP3P3SZDP'
	],
	'Contact' => [
		'id' => '01EXMSAJARWA6GH70BYFDMC06Q'
	],
]);
$jwt = JWT::encode('b2b', $payload);

$b2b = _b2b_api(); // Uses GuzzleHTTP
$res = $b2b->get('/api/b2b', [
	'headers' => [
		'authorization' => sprintf('Bearer %s', $jwt),
	]
]);

Payload Context

We do not need to do extra validation the JWT tokens because the payloads are signed and ecrypted with our secret keys.

Non-standard contextual data will come from "private claims" in the payload.

Example Workflow

App authorizes requests on behalf of the user to make requests against B2B, and find out of the user has any new orders.

1. App captures the user's company and contact session information
2. And gets the B2B service configuration
3. Then it uses the JWT library to mint the JWT token
4. And the JWT token is issued in the Authorization header in the request to B2B /api/b2b