Jwt-auth: Get payload of expired token

[markusjwetzel]

Is it possible to get the payload or at least the jti claim of an expired token?

[tdhsmith]

It isn't straightforward because it doesn't come up that often (and you don't really want people to be able to do it by accident). But you can certainly access Namshi, the package that currently handles all the encoding and decoding:

$claims = JWTAuth::getJWTProvider()->decode($token);

That'll output an array of the token's claims, including its jti.

[markusjwetzel]

That's exactly what I was searching for, thank you! :)

[dvlpr91]

not working.

[n0minal]

Not working for me too, I get a "token string must contain two dots" message, i really need to be able to decode my token even after it has expired cause I save which guard I'm using for this token inside of the claims itself since the JWT-Auth library does not automatically detect which guard I'm using when I try to refresh my token. That's a damn headache, @tymondesigns please help us.

[xVanjaZ]

Did someone found a solution yet?

[EdwardNelson]

@xVanjaZ Here is an example of accessing the payload in a middleware.

<?php

namespace App\Http\Middleware;

use Closure;
use Tymon\JWTAuth\JWTAuth;

class RefreshToken
{
    /**
     * The JWT Authenticator.
     *
     * @var \Tymon\JWTAuth\JWTAuth
     */
    protected $auth;

    /**
     * Create a new BaseMiddleware instance.
     *
     * @param  \Tymon\JWTAuth\JWTAuth  $auth
     *
     * @return void
     */
    public function __construct(JWTAuth $auth)
    {
        $this->auth = $auth;
    }

    /**
     * Handle an incoming request.
     *
     * @param  \Illuminate\Http\Request  $request
     * @param  \Closure  $next
     * @return mixed
     */
    public function handle($request, Closure $next)
    {

        $token = $this->auth->parser()->setRequest($request)->parseToken();

        $payload = app('tymon.jwt.provider.jwt')->decode($token);

        return $next($request);
    }
}

We retrieve the token via the parse instance, so that we bypass any expiration checks. Then we get the instance of the JWT provider that is bound to the IoC container and use it to decode the token we retrieved.