签名验证

签名验证

【免费下载链接】php-jwt 项目地址: https://gitcode.com/gh_mirrors/ph/php-jwt

•  确保未使用'none'算法
•  验证所有环境都启用签名检查

密钥安全

•  密钥长度符合要求(RSA≥2048, EC≥256)
•  密钥未硬编码在代码中
•  密钥定期轮换(≤90天)

令牌管理

•  设置合理的exp(≤1800秒)
•  启用jti防重放
•  实现令牌撤销机制

### 5.2 应急响应流程图
![mermaid](https://web-api.gitcode.com/mermaid/svg/eNo10EtOwkAcBvC9p-gRfG48gmsTT0BiE2DVAxSL2md42GACRK1S07hoAXnUFsJl-v2ns_IKDh2c5cz3-883o6mNWl1t1o4UsTRVq9eUq5trxBbuoyJzinyFJw-ZT8sWi5wqddxQm8qlQh86LR1s7pCmgvAvt0xamMzKRUg7He8vVfhChtFNYEf7OXqIaYfl7d-Ny4c--8zRecZ2Jm6hsQc7qNTJgVF_wn2dvtt8PEfywPuhYMx_JbNLg6ncqcDZoRR_9MQBNyK2nctGcqpg2GQwVzDXIkCWTmOryCfMcit_eitwuRuVgSvfjjgo4z1jQYx4KBuWroHRQoLzvUCnh9SQ_0R2iJ6N_v8A-w2jjAY_FJh_KJbPag)

## 6. 实战案例与代码演练

### 6.1 安全编码实验室
**实验1：修复易受攻击的JWT验证代码**

**原始代码**：
```php
function verifyToken($token) {
    $secret = 'hardcoded_secret'; // 硬编码密钥
    return JWT::decode($token, new Key($secret, 'HS256'));
}

修复步骤：

1. 将密钥移至环境变量
2. 增加算法验证
3. 添加令牌过期检查
4. 实现日志审计

修复后代码：

function verifyToken($token) {
    $secret = getenv('JWT_SECRET');
    if (empty($secret)) {
        throw new RuntimeException('JWT密钥未配置');
    }
    
    $key = new Key($secret, 'HS256');
    try {
        $payload = JWT::decode($token, $key);
        
        // 记录审计日志
        $logger->info('JWT验证成功', [
            'jti' => $payload->jti,
            'user_id' => $payload->sub,
            'expires_at' => date('Y-m-d H:i:s', $payload->exp)
        ]);
        return $payload;
    } catch (ExpiredException $e) {
        $logger->warning('令牌已过期', ['token' => substr($token, 0, 10)]);
        throw new SecurityException('令牌已过期');
    } catch (SignatureInvalidException $e) {
        $logger->error('签名验证失败', ['token' => substr($token, 0, 10)]);
        throw new SecurityException('无效的令牌');
    }
}

6.2 安全测试用例

// JWT安全测试用例示例
public function testJwtSecurity() {
    // 测试1: 签名篡改检测
    $modifiedToken = $this->tamperTokenSignature($validToken);
    $this->expectException(SignatureInvalidException::class);
    JWT::decode($modifiedToken, $this->publicKey);
    
    // 测试2: 过期令牌拒绝
    $expiredToken = $this->generateExpiredToken();
    $this->expectException(ExpiredException::class);
    JWT::decode($expiredToken, $this->publicKey);
    
    // 测试3: 算法降级攻击防御
    $noneAlgToken = $this->generateNoneAlgToken();
    $this->expectException(UnexpectedValueException::class);
    JWT::decode($noneAlgToken, $this->publicKey);
}

【免费下载链接】php-jwt 项目地址: https://gitcode.com/gh_mirrors/ph/php-jwt