Backend Security Authentication

When to use this skill

• User login/registration
• API authentication
• Session management
• Password security

Workflow

• Hash passwords properly
• Generate secure tokens
• Validate credentials
• Implement logout
• Refresh tokens

Instructions

Password Hashing

<?php

// Hash
$hash = password_hash($password, PASSWORD_DEFAULT);

// Verify
if (password_verify($inputPassword, $user->password)) {
    // Correct
}

JWT Authentication

<?php

use Firebase\JWT\JWT;

class AuthService
{
    public function generateToken(User $user): string
    {
        $payload = [
            'iss' => 'myapp',
            'sub' => $user->id,
            'iat' => time(),
            'exp' => time() + 3600
        ];

        return JWT::encode($payload, env('JWT_SECRET'), 'HS256');
    }

    public function validateToken(string $token): ?object
    {
        try {
            return JWT::decode($token, new Key(env('JWT_SECRET'), 'HS256'));
        } catch (\Exception $e) {
            return null;
        }
    }
}

Resources

• Never store plain passwords
• Use strong JWT secrets
• Implement token refresh