Slim JWT Auth
A PSR-7 and PSR-15 compatible middleware for JWT authentication in PHP applications.
What is Slim JWT Auth?
tuupola/slim-jwt-auth is a PHP middleware that handles JSON Web Token authentication for applications using PSR-7 and PSR-15 standards. It validates JWT tokens from HTTP headers or cookies, enabling secure API access without implementing a full authentication server. It solves the problem of adding standardized, framework-agnostic JWT protection to PHP web services.
PHP developers building RESTful APIs or web applications with frameworks like Slim or Zend Expressive that need JWT-based authentication middleware.
Developers choose this middleware for its strict adherence to PSR standards, making it interoperable across frameworks, and its focused design that handles only token validation—keeping it lightweight and flexible for integration into existing authentication flows.
Overview
PSR-7 and PSR-15 JWT Authentication Middleware
Use Cases
Best For
- Adding JWT authentication to Slim Framework APIs
- Securing Zend Expressive applications with token-based access
- Protecting specific API routes with configurable path rules
- Implementing custom authorization logic based on JWT claims
- Developing microservices that require PSR-compliant middleware
- Building stateless authentication for PHP REST APIs
Not Ideal For
- Projects needing a complete authentication system with token generation and user management
- Teams requiring active maintenance, regular updates, and long-term support
- Applications built on non-PSR compliant or legacy PHP frameworks
- New developments where future-proofing and community adoption are priorities
Pros & Cons
Pros
Works with any PHP framework supporting PSR-7 and PSR-15 middleware interfaces, ensuring broad interoperability and ease of integration.
Supports tokens from Authorization headers, custom headers, and cookies, with configurable regex patterns for parsing, as shown in the 'header' and 'regexp' options.
Allows specifying protected routes and exceptions via 'path' and 'ignore' parameters, enabling targeted authentication without affecting public endpoints.
Provides 'before', 'after', and 'error' callbacks for custom request/response handling and logging, documented with examples for customization.
Cons
Officially marked as abandoned with no future updates or security patches, redirecting users to a replacement package (jimtools/jwt-auth), which poses risks for production use.
Only handles token validation and parsing, leaving token generation, storage, and refresh mechanisms to be implemented separately, increasing development overhead.
Requires careful setup to avoid vulnerabilities, such as enabling both HS256 and RS256 algorithms, which is warned against in the README as a security risk.
Frequently Asked Questions
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.