JSON Web Token Cookie Login
This extension implements quasi-stateless JWT-based sessions in Flarum.
The use case for this extension is implementing global login with an external platform serving as the master.
Your code is responsible for setting and updating the cookie, and Flarum will automatically connect and/or create users based on the content of the JWT.
No example code is available for the master implementation.
The information in the README should allow you to implement it in any programming language.
Users are matched through the
jwt_subject column in the database that is matched to the token's
By default, tokens are validated using Google Firebase public keys (automatically retrieved and cached from Google servers) but custom keys can also be used.
A callback hook can be defined to obtain default values for new users from an external API.
Users can be edited via their JWT subject ID by using the
PATCH /api/jwt/users/<sub> endpoint.
It works exactly the same way as
PATCH /api/users/<id> but takes the JWT subject ID instead of Flarum ID.
The original Flarum session object (Symfony session) and cookie are not used for stateless authentication, however the cookie session is kept because Flarum and some extensions cannot work without it.
This session object is not invalidated during "login" and "logout" of the stateless JWT authentication, so there could be issues with extensions that rely on that object for other purposes than validation messages.
An optional hidden iframe with cross-window messaging can be used to trigger auto-login and auto-logout, or to update the JWT continuously with a longer lifetime.
See up to date documentation for the hooks and iframe implementation in the README clarkwinkelmann/flarum-ext-jwt-cookie-login
composer require clarkwinkelmann/flarum-ext-jwt-cookie-login
This extension is under minimal maintenance.
It was developed for a client and released as open-source for the benefit of the community.
I might publish simple bugfixes or compatibility updates for free.
You can contact me to sponsor additional features or updates.
Support is offered on a "best effort" basis through the Flarum community thread.