Forum Laravel Passport access token verify with user IP

damku999

posted 2 years ago

Authentication Laravel Security

Last updated 10 months ago.

firtzberg

replied 2 years ago

I am not 100% sure, but I think you want to override the createToken() method in ApiTokenCookieFactory. Add the IP in there.

Then you might wanna take the IP from the decoded JWT and throw an exception if it doesn't match the current on. Looks like you can do it in the decodeJwtTokenCookie() method of TokenGuard.

wolfiton

replied 2 years ago

Are you storing those ips in the database @damku999 or only in the jwt?

firtzberg

replied 2 years ago

This will only have effect if you save the jwt into the cookie. It seems the Firebase JWT PHP package is used for cookies and the League's server for Bearer tokens.

To save it in the Bearer token as well, you need to dig deeper into League's server implementation. I did so and it seems that they use lcobucci's library to handle the validation. You should implement your own constraint and somehow append it.