I have a website built on PHP, and now I want users to be able to log in. I do not want to take care of user management myself, so I'm thinking that social sign in would be convenient both for myself and for the users. The website is a traditional "server rendered" site, i.e. I have a database on my server, and my PHP-scripts need some form of user authentication/user id in order to insert and retrieve stuff from the database.

I have used Firebase auth and FirebaseUI for "client side" websites before, which is really nice since they take care of everything, including the UI and login flow.

But when it comes to using it for a traditional "server-side" application, I'm confused. I guess I can use FirebaseUI on the browser to get the user to sign in and retrieve a JWT token, but then what? How would I pass it to the server scripts on each request? Or should I just pass it once and start a session based on the information in the JWT token? Or should I use something entirely different?


From the JWT Website:

Whenever the user wants to access a protected route or resource, the user agent should send the JWT, typically in the Authorization header using the Bearer schema. The content of the header should look like the following:

Authorization: Bearer <token>

Once the user has been authenticated, you can proceed however you want of course:

  • start a session for future authentication (I wouldn't recommend this if you can already do it with the JWT)
  • create and send your own JWT (if you need additional data)
  • just keep using the third party JWT if that's all you need

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.