**Course Title:** Mastering Symfony: Building Enterprise-Level PHP Applications **Section Title:** Building RESTful APIs with Symfony **Topic:** API authentication with JWT (JSON Web Tokens) or OAuth2 API authentication is a crucial aspect of building RESTful APIs. It ensures that only authorized users can access sensitive data and perform specific actions on the system. In this topic, we'll explore two popular authentication methods for APIs: JSON Web Tokens (JWT) and OAuth2. **JSON Web Tokens (JWT)** JSON Web Tokens is a lightweight authentication mechanism that uses a JSON-based token to verify the authenticity of a user. A JWT token is generated by the server and sent to the client upon a successful login request. The client then includes this token in every subsequent request to the API, allowing the server to verify the user's identity. Here's a high-level overview of the JWT authentication process: 1. **Client Request**: The client sends a login request to the API with the user's credentials (username and password). 2. **Server Response**: The server verifies the user's credentials and generates a JWT token if the credentials are valid. 3. **Token Generation**: The JWT token is generated using a secret key and contains information such as the user's ID, username, and expiration time. 4. **Client Storage**: The client stores the JWT token securely, usually in local storage or cookies. 5. **Subsequent Requests**: The client includes the JWT token in every subsequent request to the API by adding it to the `Authorization` header. 6. **Server Verification**: The server verifies the JWT token by checking its signature and payload. If the token is valid, the server grants access to the requested resource. **Symfony Integration** Symfony provides a built-in JWT bundle called `lexik_jwt_authentication` that simplifies the JWT authentication process. To install this bundle, run the following command: ```bash composer require lexik_jwt_authentication ``` **Example Configuration** Here's an example configuration for the `lexik_jwt_authentication` bundle in `config/packages/jwt.yaml`: ```yml lexik_jwt_authentication: secret_key: '%kernel.project_dir%/config/jwt/private_key' public_key: '%kernel.project_dir%/config/jwt/public_key' pass_phrase: 'your_pass_phrase' token_ttl: 3600 ``` **Generating JWT Token** To generate a JWT token, create a controller that handles the login request and returns the token: ```php // src/Controller/LoginController.php use Lexik\Bundle\JWTAuthenticationBundle\Event\JWTAuthenticatedEvent; use Lexik\Bundle\JWTAuthenticationBundle\Response\JWTAuthenticationSuccessResponse; class LoginController extends Controller { /** * @Route("/login", name="login") */ public function login(Request $request, AuthenticationManagerInterface $authenticationManager) { $username = $request->request->get('username'); $password = $request->request->get('password'); $token = $authenticationManager->authenticate($username, $password); return new JWTAuthenticationSuccessResponse($token); } } ``` **OAuth2** OAuth2 is a widely adopted authorization framework that allows users to grant access to their resources on one website to another website without sharing their credentials. OAuth2 uses a complex flow involving multiple parties: 1. **Client**: The application requesting access to the user's resources. 2. **Resource Server**: The server hosting the user's resources. 3. **Authorization Server**: The server responsible for authenticating the user and issuing access tokens. Here's an overview of the OAuth2 authorization flow: 1. **Client Registration**: The client registers with the authorization server and receives a client ID and client secret. 2. **User Redirect**: The client redirects the user to the authorization server to authenticate. 3. **User Authentication**: The user authenticates with the authorization server. 4. **Authorization Grant**: The authorization server grants the client an authorization grant code. 5. **Token Request**: The client requests an access token from the authorization server using the authorization grant code. 6. **Token Response**: The authorization server issues an access token to the client. 7. **Resource Request**: The client uses the access token to request the user's resources from the resource server. **Symfony Integration** Symfony provides a built-in OAuth2 bundle called `f_os2l_oauth_server` that simplifies the OAuth2 authorization process. To install this bundle, run the following command: ```bash composer require f-os2l/oauth-server ``` **Example Configuration** Here's an example configuration for the `f_os2l_oauth_server` bundle in `config/packages/oauth_server.yaml`: ```yml f_os2l_oauth_server: # ... ``` **Conclusion** In this topic, we explored two popular authentication methods for APIs: JSON Web Tokens (JWT) and OAuth2. We discussed the high-level overview of each method and provided examples of how to integrate them with Symfony. JWT is a lightweight authentication mechanism that uses a JSON-based token to verify the authenticity of a user, while OAuth2 is a widely adopted authorization framework that allows users to grant access to their resources on one website to another website without sharing their credentials. **What's Next?** In the next topic, we'll introduce Symfony services and the service container. We'll learn how to define and use services, and explore the different types of services available in Symfony. **Leave a comment below if you have any questions or need further clarification on any of the topics covered in this section.** References: * [JSON Web Tokens (JWT)](https://jwt.io/) * [OAuth2](https://oauth.net/2/) * [lexik_jwt_authentication](https://github.com/lexik/LexikJWTAuthenticationBundle) * [f_os2l_oauth_server](https://github.com/fos2l/oauth-server)