PHP现代化API开发实战：构建高性能RESTful服务与JWT认证系统 | 后端开发教程

JWT令牌生成器

<?php

namespace AppInfrastructureAuth;

use FirebaseJWTJWT;
use FirebaseJWTKey;
use RamseyUuidUuid;

class JwtTokenService
{
    private string $secretKey;
    private int $expirationTime;
    
    public function __construct(string $secretKey, int $expirationTime = 3600)
    {
        $this->secretKey = $secretKey;
        $this->expirationTime = $expirationTime;
    }
    
    /**
     * 生成访问令牌
     */
    public function generateAccessToken(array $userData): string
    {
        $issuedAt = time();
        $expireAt = $issuedAt + $this->expirationTime;
        
        $payload = [
            'iss' => 'api.yourdomain.com',      // 签发者
            'aud' => 'api.yourdomain.com',      // 接收方
            'iat' => $issuedAt,                 // 签发时间
            'nbf' => $issuedAt,                 // 生效时间
            'exp' => $expireAt,                 // 过期时间
            'jti' => Uuid::uuid4()->toString(), // 唯一标识
            'data' => [                         // 用户数据
                'user_id' => $userData['id'],
                'email' => $userData['email'],
                'roles' => $userData['roles'] ?? ['user']
            ]
        ];
        
        return JWT::encode($payload, $this->secretKey, 'HS256');
    }
    
    /**
     * 生成刷新令牌
     */
    public function generateRefreshToken(): string
    {
        return bin2hex(random_bytes(32));
    }
    
    /**
     * 验证并解码令牌
     */
    public function validateToken(string $token): ?array
    {
        try {
            $decoded = JWT::decode($token, new Key($this->secretKey, 'HS256'));
            return (array) $decoded;
        } catch (Exception $e) {
            // 记录日志但不暴露具体错误信息
            error_log('JWT验证失败: ' . $e->getMessage());
            return null;
        }
    }
    
    /**
     * 刷新访问令牌
     */
    public function refreshToken(string $oldToken): ?string
    {
        $decoded = $this->validateToken($oldToken);
        
        if (!$decoded) {
            return null;
        }
        
        // 检查令牌是否即将过期（最后5分钟）
        $currentTime = time();
        $tokenExpire = $decoded['exp'];
        
        if (($tokenExpire - $currentTime) > 300) {
            // 令牌还有超过5分钟有效期，无需刷新
            return null;
        }
        
        // 生成新令牌
        return $this->generateAccessToken($decoded['data']);
    }
}

认证中间件

<?php

namespace AppApplicationMiddleware;

use PsrHttpMessageResponseInterface;
use PsrHttpMessageServerRequestInterface;
use PsrHttpServerMiddlewareInterface;
use PsrHttpServerRequestHandlerInterface;
use AppInfrastructureAuthJwtTokenService;

class AuthenticationMiddleware implements MiddlewareInterface
{
    private JwtTokenService $jwtService;
    
    public function __construct(JwtTokenService $jwtService)
    {
        $this->jwtService = $jwtService;
    }
    
    public function process(
        ServerRequestInterface $request, 
        RequestHandlerInterface $handler
    ): ResponseInterface {
        // 获取Authorization头
        $authHeader = $request->getHeaderLine('Authorization');
        
        if (empty($authHeader) || !str_starts_with($authHeader, 'Bearer ')) {
            return $this->createUnauthorizedResponse('缺少认证令牌');
        }
        
        // 提取JWT令牌
        $token = substr($authHeader, 7);
        
        // 验证令牌
        $decoded = $this->jwtService->validateToken($token);
        
        if (!$decoded) {
            return $this->createUnauthorizedResponse('令牌无效或已过期');
        }
        
        // 将用户信息添加到请求属性中
        $request = $request->withAttribute('user', $decoded['data']);
        
        // 继续处理请求
        return $handler->handle($request);
    }
    
    private function createUnauthorizedResponse(string $message): ResponseInterface
    {
        $response = new NyholmPsr7Response();
        $response->getBody()->write(json_encode([
            'error' => 'Unauthorized',
            'message' => $message,
            'code' => 401
        ]));
        
        return $response
            ->withStatus(401)
            ->withHeader('Content-Type', 'application/json')
            ->withHeader('WWW-Authenticate', 'Bearer realm="API"');
    }
}

速率限制中间件

<?php

namespace AppApplicationMiddleware;

use PsrHttpMessageResponseInterface;
use PsrHttpMessageServerRequestInterface;
use PsrHttpServerMiddlewareInterface;
use PsrHttpServerRequestHandlerInterface;
use AppInfrastructureCacheRateLimiter;

class RateLimitMiddleware implements MiddlewareInterface
{
    private RateLimiter $rateLimiter;
    private int $maxRequests;
    private int $timeWindow;
    
    public function __construct(
        RateLimiter $rateLimiter, 
        int $maxRequests = 100, 
        int $timeWindow = 3600
    ) {
        $this->rateLimiter = $rateLimiter;
        $this->maxRequests = $maxRequests;
        $this->timeWindow = $timeWindow;
    }
    
    public function process(
        ServerRequestInterface $request, 
        RequestHandlerInterface $handler
    ): ResponseInterface {
        $clientIp = $request->getServerParams()['REMOTE_ADDR'] ?? 'unknown';
        $route = $request->getUri()->getPath();
        
        $key = "rate_limit:{$clientIp}:{$route}";
        
        if (!$this->rateLimiter->attempt($key, $this->maxRequests, $this->timeWindow)) {
            return $this->createRateLimitResponse();
        }
        
        $response = $handler->handle($request);
        
        // 添加速率限制头部信息
        $remaining = $this->rateLimiter->remaining($key, $this->maxRequests);
        $resetTime = $this->rateLimiter->resetTime($key, $this->timeWindow);
        
        return $response
            ->withHeader('X-RateLimit-Limit', (string)$this->maxRequests)
            ->withHeader('X-RateLimit-Remaining', (string)$remaining)
            ->withHeader('X-RateLimit-Reset', (string)$resetTime);
    }
    
    private function createRateLimitResponse(): ResponseInterface
    {
        $response = new NyholmPsr7Response();
        $response->getBody()->write(json_encode([
            'error' => 'Too Many Requests',
            'message' => '请求过于频繁，请稍后再试',
            'code' => 429
        ]));
        
        return $response
            ->withStatus(429)
            ->withHeader('Content-Type', 'application/json')
            ->withHeader('Retry-After', '3600');
    }
}

4.1 数据库查询优化

// 使用查询构建器优化
$users = DB::table('users')
    ->select(['id', 'name', 'email', 'created_at'])
    ->where('status', 'active')
    ->when($request->has('role'), function ($query) use ($request) {
        return $query->where('role', $request->input('role'));
    })
    ->orderBy('created_at', 'desc')
    ->cursorPaginate(20); // 使用游标分页

// 预加载关联数据
$posts = Post::with(['author:id,name', 'tags:id,name'])
    ->whereHas('comments', function ($query) {
        $query->where('approved', true);
    })
    ->get();

4.2 缓存策略实现

class CachedUserRepository
{
    private UserRepository $repository;
    private CacheInterface $cache;
    private int $ttl;
    
    public function findById(string $id): ?User
    {
        $cacheKey = "user:{$id}";
        
        return $this->cache->remember($cacheKey, $this->ttl, 
            function () use ($id) {
                return $this->repository->findById($id);
            }
        );
    }
    
    public function invalidateCache(string $userId): void
    {
        $this->cache->delete("user:{$userId}");
        $this->cache->delete('users:list');
    }
}

4.3 安全防护措施

// SQL注入防护（使用参数绑定）
$users = DB::select(
    'SELECT * FROM users WHERE email = ? AND status = ?',
    [$email, 'active']
);

// XSS防护
$cleanInput = htmlspecialchars(
    $input, 
    ENT_QUOTES | ENT_HTML5, 
    'UTF-8'
);

// CSRF令牌验证
if (!hash_equals($_SESSION['csrf_token'], $requestToken)) {
    throw new Exception('CSRF令牌验证失败');
}

// 密码安全存储
$hashedPassword = password_hash(
    $password, 
    PASSWORD_ARGON2ID, 
    ['memory_cost' => 65536, 'time_cost' => 4]
);