JWTRefreshTokenBundle

The bundle dispatches several events that you can listen to for custom logic during the token lifecycle:

• gesdinet.refresh_token: Dispatched when a token is successfully refreshed. Carries a Gesdinet\JWTRefreshTokenBundle\Event\RefreshEvent object.
• gesdinet.refresh_token_failure: Dispatched when refresh token authentication fails. Carries a Gesdinet\JWTRefreshTokenBundle\Event\RefreshAuthenticationFailureEvent object.
• gesdinet.refresh_token_not_found: Dispatched when a refresh token cannot be found. Carries a Gesdinet\JWTRefreshTokenBundle\Event\RefreshTokenNotFoundEvent object.

If you are using Symfony Flex, the bundle should be registered automatically. If not, manually add the bundle to your config/bundles.php file.

<?php
return [
    //...
    Gesdinet\JWTRefreshTokenBundle\GesdinetJWTRefreshTokenBundle::class => ['all' => true],
];

To install the bundle using Doctrine ORM, you must also install the Doctrine ORM and Doctrine Bundle packages, as they are not automatically included.

composer require doctrine/orm doctrine/doctrine-bundle gesdinet/jwt-refresh-token-bundle

Add a route for the refresh token endpoint in your routing configuration (e.g., config/routes.yaml).

# config/routes.yaml
api_refresh_token:
    path: /api/token/refresh

To install the bundle using Doctrine MongoDB ODM, you must also install the MongoDB ODM and its bundle packages.

composer require doctrine/mongodb-odm doctrine/mongodb-odm-bundle gesdinet/jwt-refresh-token-bundle

To upgrade JWTRefreshTokenBundle from version 1.x to 2.0, ensure your environment meets the new requirements and update your configuration to replace deprecated nodes.

Bundle Requirements

• Symfony: 6.4 or 7.2+
• PHP: 8.2 or later

You must add the refresh token table/collection to your database. It is highly recommended to use migrations.

Using MakerBundle:

php bin/console make:migration

Without MakerBundle:

php bin/console doctrine:migrations:diff
php bin/console doctrine:migrations:migrate

Not Recommended (Direct Schema Update):

php bin/console doctrine:schema:update --force

Before installing, ensure your environment meets the following requirements:

• PHP: 8.2 or later
• Symfony: 6.4, 7.2+, or 8.0+

Note: For older Symfony versions, use the 1.x release of the bundle. It is highly recommended to use HTTPS in production environments.

The bundle listens for LogoutEvent to automatically invalidate the current refresh token and unset its cookie.

To implement this:

1. Define a logout path in your firewall in security.yaml.
2. Define a corresponding route in routes.yaml.
3. (Optional) If using a non-default firewall, specify logout_firewall in the bundle configuration.

Example Setup:

# config/packages/security.yaml
security:
    firewalls:
        api:
            logout:
                path: api_token_invalidate

# config/routes.yaml
api_token_invalidate:
    path: /api/token/invalidate

When using multiple extractors, you can control the order in which they are executed by assigning a priority to the gesdinet_jwt_refresh_token.request_extractor tag. A higher number means the extractor will be run sooner.

services:
    App\Request\Extractor\HeaderExtractor:
        tags:
            - { name: gesdinet_jwt_refresh_token.request_extractor, priority: 25 }

Create a configuration file at config/packages/gesdinet_jwt_refresh_token.yaml to specify the class name of your refresh token entity/document. You must adjust the refresh_token_class value to match the actual class used in your application.

gesdinet_jwt_refresh_token:
    refresh_token_class: App\Entity\RefreshToken