ROOG
c6d6534b63
- 添加用户管理功能的测试，包括创建、更新、停用、激活用户及用户登录 JWT 测试 - 提供用户管理相关的请求验证类与控制器 - 引入 CORS 配置信息，支持跨域请求 - 添加数据库播种器以便创建根用户 - 配置 API 默认使用 JWT 认证 - 添加聊天会话和消息的模型、迁移文件及关联功能
322 lines
11 KiB
PHP
322 lines
11 KiB
PHP
<?php
|
|
|
|
return [
|
|
/*
|
|
|--------------------------------------------------------------------------
|
|
| JWT Authentication Secret
|
|
|--------------------------------------------------------------------------
|
|
|
|
|
| Don't forget to set this in your .env file, as it will be used to sign
|
|
| your tokens. A helper command is provided for this:
|
|
| `php artisan jwt:secret`
|
|
|
|
|
| Note: This will be used for Symmetric algorithms only (HMAC),
|
|
| since RSA and ECDSA use a private/public key combo (See below).
|
|
|
|
|
*/
|
|
|
|
'secret' => env('JWT_SECRET'),
|
|
|
|
/*
|
|
|--------------------------------------------------------------------------
|
|
| JWT Authentication Keys
|
|
|--------------------------------------------------------------------------
|
|
|
|
|
| The algorithm you are using, will determine whether your tokens are
|
|
| signed with a random string (defined in `JWT_SECRET`) or using the
|
|
| following public & private keys.
|
|
|
|
|
| Symmetric Algorithms:
|
|
| HS256, HS384 & HS512 will use `JWT_SECRET`.
|
|
|
|
|
| Asymmetric Algorithms:
|
|
| RS256, RS384 & RS512 / ES256, ES384 & ES512 will use the keys below.
|
|
|
|
|
*/
|
|
|
|
'keys' => [
|
|
/*
|
|
|--------------------------------------------------------------------------
|
|
| Public Key
|
|
|--------------------------------------------------------------------------
|
|
|
|
|
| A path or resource to your public key.
|
|
|
|
|
| E.g. 'file://path/to/public/key'
|
|
|
|
|
*/
|
|
|
|
'public' => env('JWT_PUBLIC_KEY'),
|
|
|
|
/*
|
|
|--------------------------------------------------------------------------
|
|
| Private Key
|
|
|--------------------------------------------------------------------------
|
|
|
|
|
| A path or resource to your private key.
|
|
|
|
|
| E.g. 'file://path/to/private/key'
|
|
|
|
|
*/
|
|
|
|
'private' => env('JWT_PRIVATE_KEY'),
|
|
|
|
/*
|
|
|--------------------------------------------------------------------------
|
|
| Passphrase
|
|
|--------------------------------------------------------------------------
|
|
|
|
|
| The passphrase for your private key. Can be null if none set.
|
|
|
|
|
*/
|
|
|
|
'passphrase' => env('JWT_PASSPHRASE'),
|
|
],
|
|
|
|
/*
|
|
|--------------------------------------------------------------------------
|
|
| JWT time to live
|
|
|--------------------------------------------------------------------------
|
|
|
|
|
| Specify the length of time (in minutes) that the token will be valid for.
|
|
| Defaults to 1 hour.
|
|
|
|
|
| You can also set this to null, to yield a never expiring token.
|
|
| Some people may want this behaviour for e.g. a mobile app.
|
|
| This is not particularly recommended, so make sure you have appropriate
|
|
| systems in place to revoke the token if necessary.
|
|
| Notice: If you set this to null you should remove 'exp' element from 'required_claims' list.
|
|
|
|
|
*/
|
|
|
|
'ttl' => (int) env('JWT_TTL', 60),
|
|
|
|
/*
|
|
|--------------------------------------------------------------------------
|
|
| Refresh time to live
|
|
|--------------------------------------------------------------------------
|
|
|
|
|
| Specify the length of time (in minutes) that the token can be refreshed within.
|
|
| This defines the refresh window, during which the user can refresh their token
|
|
| before re-authentication is required.
|
|
|
|
|
| By default, a refresh will NOT issue a new "iat" (issued at) timestamp. If changed
|
|
| to true, each refresh will issue a new "iat" timestamp, extending the refresh
|
|
| period from the most recent refresh. This results in a rolling refresh
|
|
|
|
|
| To retain a fluid refresh window from the last refresh action (i.e., the behavior between
|
|
| version 2.5.0 and 2.8.2), set "refresh_iat" to true. With this setting, the refresh
|
|
| window will renew with each subsequent refresh.
|
|
|
|
|
| The refresh ttl defaults to 2 weeks.
|
|
|
|
|
| You can also set this to null, to yield an infinite refresh time.
|
|
| Some may want this instead of never expiring tokens for e.g. a mobile app.
|
|
| This is not particularly recommended, so make sure you have appropriate
|
|
| systems in place to revoke the token if necessary.
|
|
|
|
|
*/
|
|
|
|
'refresh_iat' => env('JWT_REFRESH_IAT', false),
|
|
'refresh_ttl' => (int) env('JWT_REFRESH_TTL', 20160),
|
|
|
|
/*
|
|
|--------------------------------------------------------------------------
|
|
| JWT hashing algorithm
|
|
|--------------------------------------------------------------------------
|
|
|
|
|
| Specify the hashing algorithm that will be used to sign the token.
|
|
|
|
|
| See here: https://github.com/namshi/jose/tree/master/src/Namshi/JOSE/Signer/OpenSSL
|
|
| for possible values.
|
|
|
|
|
*/
|
|
|
|
'algo' => env('JWT_ALGO', 'HS256'),
|
|
|
|
/*
|
|
|--------------------------------------------------------------------------
|
|
| Required Claims
|
|
|--------------------------------------------------------------------------
|
|
|
|
|
| Specify the required claims that must exist in any token.
|
|
| A TokenInvalidException will be thrown if any of these claims are not
|
|
| present in the payload.
|
|
|
|
|
*/
|
|
|
|
'required_claims' => [
|
|
'iss',
|
|
'iat',
|
|
'exp',
|
|
'nbf',
|
|
'sub',
|
|
'jti',
|
|
],
|
|
|
|
/*
|
|
|--------------------------------------------------------------------------
|
|
| Persistent Claims
|
|
|--------------------------------------------------------------------------
|
|
|
|
|
| Specify the claim keys to be persisted when refreshing a token.
|
|
| `sub` and `iat` will automatically be persisted, in
|
|
| addition to the these claims.
|
|
|
|
|
| Note: If a claim does not exist then it will be ignored.
|
|
|
|
|
*/
|
|
|
|
'persistent_claims' => [
|
|
// 'foo',
|
|
// 'bar',
|
|
],
|
|
|
|
/*
|
|
|--------------------------------------------------------------------------
|
|
| Lock Subject
|
|
|--------------------------------------------------------------------------
|
|
|
|
|
| This will determine whether a `prv` claim is automatically added to
|
|
| the token. The purpose of this is to ensure that if you have multiple
|
|
| authentication models e.g. `App\User` & `App\OtherPerson`, then we
|
|
| should prevent one authentication request from impersonating another,
|
|
| if 2 tokens happen to have the same id across the 2 different models.
|
|
|
|
|
| Under specific circumstances, you may want to disable this behaviour
|
|
| e.g. if you only have one authentication model, then you would save
|
|
| a little on token size.
|
|
|
|
|
*/
|
|
|
|
'lock_subject' => true,
|
|
|
|
/*
|
|
|--------------------------------------------------------------------------
|
|
| Leeway
|
|
|--------------------------------------------------------------------------
|
|
|
|
|
| This property gives the jwt timestamp claims some "leeway".
|
|
| Meaning that if you have any unavoidable slight clock skew on
|
|
| any of your servers then this will afford you some level of cushioning.
|
|
|
|
|
| This applies to the claims `iat`, `nbf` and `exp`.
|
|
|
|
|
| Specify in seconds - only if you know you need it.
|
|
|
|
|
*/
|
|
|
|
'leeway' => (int) env('JWT_LEEWAY', 0),
|
|
|
|
/*
|
|
|--------------------------------------------------------------------------
|
|
| Blacklist Enabled
|
|
|--------------------------------------------------------------------------
|
|
|
|
|
| In order to invalidate tokens, you must have the blacklist enabled.
|
|
| If you do not want or need this functionality, then set this to false.
|
|
|
|
|
*/
|
|
|
|
'blacklist_enabled' => env('JWT_BLACKLIST_ENABLED', true),
|
|
|
|
/*
|
|
| -------------------------------------------------------------------------
|
|
| Blacklist Grace Period
|
|
| -------------------------------------------------------------------------
|
|
|
|
|
| When multiple concurrent requests are made with the same JWT,
|
|
| it is possible that some of them fail, due to token regeneration
|
|
| on every request.
|
|
|
|
|
| Set grace period in seconds to prevent parallel request failure.
|
|
|
|
|
*/
|
|
|
|
'blacklist_grace_period' => (int) env('JWT_BLACKLIST_GRACE_PERIOD', 0),
|
|
|
|
/*
|
|
|--------------------------------------------------------------------------
|
|
| Show blacklisted token option
|
|
|--------------------------------------------------------------------------
|
|
|
|
|
| Specify if you want to show black listed token exception on the laravel logs.
|
|
|
|
|
*/
|
|
|
|
'show_black_list_exception' => env('JWT_SHOW_BLACKLIST_EXCEPTION', true),
|
|
|
|
/*
|
|
|--------------------------------------------------------------------------
|
|
| Cookies encryption
|
|
|--------------------------------------------------------------------------
|
|
|
|
|
| By default Laravel encrypt cookies for security reason.
|
|
| If you decide to not decrypt cookies, you will have to configure Laravel
|
|
| to not encrypt your cookie token by adding its name into the $except
|
|
| array available in the middleware "EncryptCookies" provided by Laravel.
|
|
| see https://laravel.com/docs/master/responses#cookies-and-encryption
|
|
| for details.
|
|
|
|
|
| Set it to true if you want to decrypt cookies.
|
|
|
|
|
*/
|
|
|
|
'decrypt_cookies' => false,
|
|
|
|
/*
|
|
|--------------------------------------------------------------------------
|
|
| Cookie key name
|
|
|--------------------------------------------------------------------------
|
|
|
|
|
| Specify the cookie key name that you would like to use for the cookie token.
|
|
|
|
|
*/
|
|
|
|
'cookie_key_name' => 'token',
|
|
|
|
/*
|
|
|--------------------------------------------------------------------------
|
|
| Providers
|
|
|--------------------------------------------------------------------------
|
|
|
|
|
| Specify the various providers used throughout the package.
|
|
|
|
|
*/
|
|
|
|
'providers' => [
|
|
/*
|
|
|--------------------------------------------------------------------------
|
|
| JWT Provider
|
|
|--------------------------------------------------------------------------
|
|
|
|
|
| Specify the provider that is used to create and decode the tokens.
|
|
|
|
|
*/
|
|
|
|
'jwt' => PHPOpenSourceSaver\JWTAuth\Providers\JWT\Lcobucci::class,
|
|
|
|
/*
|
|
|--------------------------------------------------------------------------
|
|
| Authentication Provider
|
|
|--------------------------------------------------------------------------
|
|
|
|
|
| Specify the provider that is used to authenticate users.
|
|
|
|
|
*/
|
|
|
|
'auth' => PHPOpenSourceSaver\JWTAuth\Providers\Auth\Illuminate::class,
|
|
|
|
/*
|
|
|--------------------------------------------------------------------------
|
|
| Storage Provider
|
|
|--------------------------------------------------------------------------
|
|
|
|
|
| Specify the provider that is used to store tokens in the blacklist.
|
|
|
|
|
*/
|
|
|
|
'storage' => PHPOpenSourceSaver\JWTAuth\Providers\Storage\Illuminate::class,
|
|
],
|
|
];
|