一、安装Dingo API 和 JWT

1. 执行composer命令

composer require dingo/api
composer require tymon/jwt-auth

2. 修改config/app.php

'providers' => [
	Tymon\JWTAuth\Providers\LaravelServiceProvider::class,
]
'aliases' => [
    'JWTAuth' => Tymon\JWTAuth\Facades\JWTAuth::class,
    'JWTFactory' => Tymon\JWTAuth\Facades\JWTFactory::class,
]

3. 执行命令发布配置

php artisan vendor:publish --provider="Dingo\Api\Provider\LaravelServiceProvider"
php artisan vendor:publish --provider="Tymon\JWTAuth\Providers\JWTAuthServiceProvider"

4. 添加.env配置

API_STANDARDS_TREE=vnd # 表示公开发布的项目
API_SUBTYPE=myapp # 项目缩写
API_PREFIX=api # 前缀，不需要可以填写'/'，和API_DOMAIN二选一
API_VERSION=v1 # 版本号
API_NAME=myapp # 名字（使用API Blueprint命令生成文档是才会用到）
API_CONDITIONAL_REQUEST=false # 条件请求默认为开启状态，这有利于客户端的缓存机制在可能的情况下缓存API请求
API_STRICT=false # 严格模式将要求客户端发送Accept标头，代替配置文件中指定的版本。这意味着无法通过浏览器访问API。
API_DEFAULT_FORMAT=json # 响应格式，默认JSON格式
API_DEBUG=false # 调试模式

JWT_SECRET=VgjyyixSPOGS9DqOuwNDmGvuqiq4c5MKBfK16uCb11ihbYadG9N8KjqMoBBDkk1q #密钥 通过php artisan jwt:secret命令生成
JWT_TTL=60 #token有效期，默认60分钟，单位分钟，ttl失效，refresh_ttl有效时可以刷新获取新的token
JWT_REFRESH_TTL=20160 #token允许刷新时间，默认20160分钟（2周），单位分钟，refresh_ttl失效后，需要重新登陆。
JWT_BLACKLIST_ENABLED=true #黑名单，默认true，建议开启，不开启无法让token失效。
JWT_BLACKLIST_GRACE_PERIOD=10 #宽限时间，单位秒，ttl失效，refresh_ttl有效时宽限时间内的请求会被允许；并发请求时，token被刷新后，防止后续请求失败。

5. 修改config/auth.php

'defaults' => [
    'guard' => 'api',
    'passwords' => 'users',
],
'guards' => [
    'api' => [
        'driver' => 'jwt',
        'provider' => 'users',
    ],
],
'providers' => [
        'users' => [
            'driver' => 'eloquent',
            'model' => App\Models\PreUsersModel::class,
        ],
    ],

二、修改Model

<?php

namespace App\Models;

use Illuminate\Foundation\Auth\User as Authenticatable;
use Tymon\JWTAuth\Contracts\JWTSubject;

class PreUsersModel extends Authenticatable implements JWTSubject
{
    
    protected $table = 'pre_users';
    protected $primaryKey = 'id';

    const STATUS_OFF = 0;
    const STATUS_ON = 1;

    public static $statusMap = [
        self::STATUS_OFF => '禁用',
        self::STATUS_ON => '启用',
    ];

    /**
     * Get the identifier that will be stored in the subject claim of the JWT.
     *
     * @return mixed
     */
    public function getJWTIdentifier()
    {
    
        return $this->getKey();
    }

    /**
     * Return a key value array, containing any custom claims to be added to the JWT.
     *
     * @return array
     */
    public function getJWTCustomClaims()
    {
    
        return [];
    }
}

三、添加路由

<?php

$api = app('Dingo\Api\Routing\Router');

$api->version('v1', ['namespace' => 'App\Api\V1\Controllers'], function ($api) {
    

    /**
     * auth
     */
    $api->post('v1/auth/login', 'AuthController@login');

    /**
     * token权限访问
     */
    $api->group(['middleware' => 'refresh.token'], function ($api) {
    

        /**
         * auth
         */
        $api->delete('v1/auth/logout', 'AuthController@logout');
        $api->put('v1/auth/refresh', 'AuthController@refresh');

        /**
         * user
         */
        $api->get('v1/user/info', 'UserController@info');
    });
});

四、添加控制器

1. app/Api/V1/Controllers/AuthController.php

<?php

namespace App\Api\V1\Controllers;

use App\Models\PreUsersModel;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Auth;
use Illuminate\Support\Facades\Hash;
use Illuminate\Support\Facades\Validator;

class AuthController extends BaseController
{
    
    /**
     * 登陆
     * @param Request $request
     * @return \Illuminate\Http\JsonResponse
     */
    public function login(Request $request)
    {
    
        $validator = Validator::make($request->all(), [
            'mobile' => 'required|string|min:11',
            'password' => 'required|string|min:5',
        ]);

        if ($validator->fails()) return response()->json(['message' => '参数错误'], 422);

        $user = PreUsersModel::where('mobile', $request->input('mobile'))->first();


        if (empty($user) || !Hash::check($request->input('password'), $user->password)) {
    
            return response()->json(['message' => '用户名或密码错误'], 500);
        }

        if ($user->status == PreUsersModel::STATUS_OFF) {
    
            return response()->json(['message' => '帐号已禁用'], 500);
        }

        if ($token = $this->guard()->fromUser($user)) {
    
            return $this->respondWithToken($token, $user);
        }

        return response()->json(['message' => '登陆失败'], 500);
    }

    /**
     * 登出
     * @return \Illuminate\Http\JsonResponse
     */
    public function logout()
    {
    
        $this->guard()->logout();

        return response()->json(['message' => '登出成功']);
    }

    /**
     * 刷新token
     * @param Request $request
     * @return \Illuminate\Http\JsonResponse
     */
    public function refresh(Request $request)
    {
    
        $user = $this->guard()->user();

        if ($user->status == PreUsersModel::STATUS_OFF) {
    
            return response()->json(['message' => '帐号已禁用'], 500);
        }

        $token = $this->guard()->refresh();

        return $this->respondWithToken($token, $user);
    }

    /**
     * 带token返回
     * @param $token
     * @param $user
     * @return \Illuminate\Http\JsonResponse
     */
    protected function respondWithToken($token, $user)
    {
    
        return response()->json([
            'access_token' => $token,
            'token_type' => 'bearer',
            'expires_in' => $this->guard()->factory()->getTTL() * 60,
            'user' => $user,
        ]);
    }

    /**
     * @return mixed
     */
    protected function guard()
    {
    
        return Auth::guard('api');
    }
}

2. app/Api/V1/Controllers/UserController.php

<?php

namespace App\Api\V1\Controllers;

class UserController extends BaseController
{
    

    /**
     * @return \Illuminate\Http\JsonResponse
     */
    public function info()
    {
    
        $user = auth()->user();

        return response()->json($user);
    }
}

五、添加中间件

1. 创建中间件

php artisan make:middleware RefreshToken

2. 修改app/Http/Kernel.php

    protected $routeMiddleware = [
        'refresh.token' => RefreshToken::class, //增加
    ];

3. 修改app/Http/Middleware/RefreshToken.php

<?php

namespace App\Http\Middleware;

use App\Models\PreUsersModel;
use Closure;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Auth;
use Tymon\JWTAuth\Exceptions\JWTException;
use Tymon\JWTAuth\Exceptions\TokenExpiredException;
use Tymon\JWTAuth\Http\Middleware\BaseMiddleware;

// 继承jwt的BaseMiddleware
class RefreshToken extends BaseMiddleware
{
    
    /**
     * @param Request $request
     * @param Closure $next
     * @return \Illuminate\Http\JsonResponse|\Illuminate\Http\Response|mixed
     * @throws JWTException
     */
    public function handle(Request $request, Closure $next)
    {
    
        // 检查请求是否携带token
        $this->checkForToken($request);

        try {
    
            // 检测用户的登录状态
            if (!$this->auth->parseToken()->authenticate()) {
    
                response()->json(['message' => '未登录'], 401);
            }

            $user = $this->auth->user();
            if ($user->status == PreUsersModel::STATUS_OFF) {
    
                return response()->json(['message' => '帐号已禁用'], 500);
            }

            return $next($request);

        } catch (TokenExpiredException $exception) {
    
            // 如果捕获到此异常，即代表ttl过期了，刷新令牌，在response的头部返回token。
            try {
    
                $user_id = $this->auth->manager()->getPayloadFactory()->buildClaimsCollection()->toPlainArray()['sub'];
                // 刷新token
                $token = $this->auth->refresh();
                // 使用一次性登录以保证此次请求的成功
                Auth::guard('api')->onceUsingId($user_id);
                // 在响应头中返回新的token
                return $this->setAuthenticationHeader($next($request), $token);
            } catch (JWTException $exception) {
    
                // 如果捕获到此异常，即代表refresh_ttl也过期了，用户无法刷新令牌，需要重新登录。
                return response()->json(['message' => '登陆状态已过期，请重新登陆'], 401);
            }
        }
    }
}

五、测试

推荐postman，下面说一下流程，就不放实测的截图了

1. 修改JWT_TTL=1，JWT_REFRESH_TTL=2，JWT_BLACKLIST_GRACE_PERIOD=10
2. 请求登陆接口获取token
3. 添加Authorization:Bearer token头部，请求用户信息接口
4. 1分钟后，token过期，宽限时间内会允许请求用户信息接口，并且response会带着Authorization:Bearer token头部返回，获取新token
5. 使用新token请求用户信息接口成功
6. 2分钟后，token过期，刷新时间也过期，提示重新登陆，response也没有Authorization头部返回