Hai teman-teman! Kalian pasti udah nggak asing lagi sama yang namanya sistem login, kan? Nah, sekarang kita bakal bahas cara bikin sistem login yang lebih modern dan aman pakai PHP dan Token JWT (JSON Web Token). Autentikasi kekinian ini nggak cuma keren, tapi juga scalable buat aplikasi web atau mobile. Yuk, kita mulai!
Apa Itu JWT?
JWT (JSON Web Token) itu kayak tiket digital yang dipake buat ngecek siapa sih user yang lagi akses aplikasi kamu. Formatnya simpel: Header, Payload, dan Signature.
Contohnya kayak gini:eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyX2lkIjoxLCJyb2xlIjoiYWRtaW4ifQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
Header: Info algoritma (misal: HS256)
Payload: Data user (misal: user_id, role)
Signature: Gabungan Header + Payload yang di-enkripsi pake secret key.
Tools yang Dibutuhkan
- PHP (versi terbaru biar aman).
- Library JWT, misalnya
firebase/php-jwt. - Database (MySQL, PostgreSQL, atau SQLite).
- Text editor favorit kamu (VSCode, Sublime, dll).
Langkah-Langkah Implementasi
1. Setup Project
Buat folder project kamu, misalnya login-jwt, terus install library JWT:
composer require firebase/php-jwt
2. Buat Database
Bikin tabel buat user:
CREATE TABLE users (
id INT AUTO_INCREMENT PRIMARY KEY,
username VARCHAR(50) NOT NULL,
password VARCHAR(255) NOT NULL,
created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
);
Pastikan password-nya di-hash ya, jangan simpan mentah!
3. File Konfigurasi
Bikin file config.php buat koneksi database:
<?php
$host = 'localhost';
$dbname = 'jwt_login';
$username = 'root';
$password = '';
try {
$pdo = new PDO("mysql:host=$host;dbname=$dbname", $username, $password);
$pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
} catch (PDOException $e) {
die("Database connection failed: " . $e->getMessage());
}
?>
4. Register User
Bikin endpoint buat register user di file register.php:
<?php
include 'config.php';
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
$username = $_POST['username'];
$password = password_hash($_POST['password'], PASSWORD_BCRYPT);
$stmt = $pdo->prepare("INSERT INTO users (username, password) VALUES (?, ?)");
if ($stmt->execute([$username, $password])) {
echo json_encode(["message" => "User registered successfully!"]);
} else {
echo json_encode(["message" => "Registration failed!"]);
}
}
?>
5. Login dan Generate Token
Bikin file login.php:
<?php
include 'config.php';
require 'vendor/autoload.php';
use Firebase\JWT\JWT;
$secret_key = "your_secret_key"; // Ganti dengan secret key kamu
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
$username = $_POST['username'];
$password = $_POST['password'];
$stmt = $pdo->prepare("SELECT * FROM users WHERE username = ?");
$stmt->execute([$username]);
$user = $stmt->fetch(PDO::FETCH_ASSOC);
if ($user && password_verify($password, $user['password'])) {
$payload = [
"user_id" => $user['id'],
"username" => $user['username'],
"iat" => time(),
"exp" => time() + (60 * 60) // Token berlaku 1 jam
];
$jwt = JWT::encode($payload, $secret_key, 'HS256');
echo json_encode(["token" => $jwt]);
} else {
echo json_encode(["message" => "Invalid username or password"]);
}
}
?>
6. Middleware untuk Validasi Token
Bikin file middleware.php:
<?php
require 'vendor/autoload.php';
use Firebase\JWT\JWT;
use Firebase\JWT\Key;
$secret_key = "your_secret_key";
function validate_token($jwt) {
try {
$decoded = JWT::decode($jwt, new Key($secret_key, 'HS256'));
return $decoded;
} catch (Exception $e) {
http_response_code(401);
echo json_encode(["message" => "Access denied: " . $e->getMessage()]);
exit();
}
}
?>
7. Endpoint Terproteksi
Bikin file protected.php:
<?php
include 'middleware.php';
$headers = getallheaders();
$authHeader = $headers['Authorization'] ?? '';
if ($authHeader) {
$jwt = str_replace('Bearer ', '', $authHeader);
$decoded = validate_token($jwt);
echo json_encode(["message" => "Access granted", "data" => $decoded]);
} else {
http_response_code(401);
echo json_encode(["message" => "Token missing"]);
}
?>
Testing Sistem Login JWT
- Register User
Kirim POST request keregister.phpdengan datausernamedanpassword. - Login
Kirim POST request kelogin.phpdengan data yang sama, dan dapetin token JWT. - Akses Endpoint Terproteksi
Gunakan token dari langkah sebelumnya sebagai header:Authorization: Bearer <your_token>
Penutup
Gimana? Gampang kan? Dengan sistem login pakai JWT ini, aplikasi kamu jadi lebih aman dan fleksibel buat diintegrasi ke berbagai platform. Jangan lupa simpan secret key kamu dengan aman, ya!
Selamat mencoba, teman-teman! 馃殌