详解多种主流Token续期方案对比解析

<?php
class TokenService
{
    private const ACCESS_TTL = 1800; // 30 分钟
    // 生成 Access Token
    public function generateToken(string $username): string
    {
        return JwtUtil::encode([
            'sub' => $username,
            'iat' => time(),
            'exp' => time() + self::ACCESS_TTL,
        ]);
    }
    // 验证 Token 是否有效
    public function validateToken(string $token): bool
    {
        try {
            $expiration = JwtUtil::getExpiration($token);
            return $expiration > time();
        } catch (Exception $e) {
            // 若解析 Token 失败，认为 Token 无效
            return false;
        }
    }
}

<?php

class TokenService
{
    private const ACCESS_TTL = 1800; // 30分钟
    private const BLACKLIST_TTL = 2100; // 35分钟

    public function refresh(string $oldToken): string
    {
        if ($this->isBlacklisted($oldToken)) {
            throw new RuntimeException('Token revoked', 401);
        }

        $payload = JwtUtil::decode($oldToken);
        $sub = $payload['sub'] ?? null;
        if (!$sub) {
            throw new RuntimeException('Invalid token', 401);
        }

        // 先拉黑旧令牌，再签发新令牌（减少并发窗口）
        $this->addBlacklist($oldToken, self::BLACKLIST_TTL);

        return JwtUtil::encode([
            'sub' => $sub,
            'iat' => time(),
            'exp' => time() + self::ACCESS_TTL,
        ]);
    }

    private function isBlacklisted(string $token): bool
    {
        return (bool) Redis::get("blacklist:{$token}");
    }

    private function addBlacklist(string $token, int $ttl): void
    {
        Redis::setex("blacklist:{$token}", $ttl, '1');
    }
}

<?php
class TokenService
{
    private const ACCESS_TTL = 900;  // 15分钟
    private const REFRESH_TTL = 604800; // 7天

    public function login(string $userId): array
    {
        $accessToken = JwtUtil::encode([
            'sub' => $userId,
            'iat' => time(),
            'exp' => time() + self::ACCESS_TTL,
            'type' => 'access',
        ]);

        $refreshToken = bin2hex(random_bytes(32));
        Redis::setex("refresh:{$refreshToken}", self::REFRESH_TTL, $userId);

        return compact('accessToken', 'refreshToken');
    }

    public function refresh(string $refreshToken): string
    {
        $userId = Redis::get("refresh:{$refreshToken}");
        if (!$userId) {
            throw new RuntimeException('Invalid or expired refresh token', 401);
        }

        // 方案A：撤销式刷新（推荐）
        Redis::del("refresh:{$refreshToken}");

        // 方案B：滑动续期（可选）
        // Redis::expire("refresh:{$refreshToken}", self::REFRESH_TTL);

        return JwtUtil::encode([
            'sub' => $userId,
            'iat' => time(),
            'exp' => time() + self::ACCESS_TTL,
            'type' => 'access',
        ]);
    }

    public function logout(string $refreshToken): void
    {
        Redis::del("refresh:{$refreshToken}");
    }
}

<?php
class TokenService
{
    private const ACCESS_TTL = 900;
    private const REFRESH_TTL = 604800;
    private const STATE_TTL = 300; // 5分钟

    public function refreshWithState(string $refreshToken, string $clientState, string $deviceId): array
    {
        $lockKey = "lock:refresh:{$refreshToken}";
        $stateKey = "state:{$clientState}";

        // 分布式锁（SETNX + EX 简化示例）
        $acquired = Redis::set($lockKey, 1, ['NX', 'EX' => 5]);
        if (!$acquired) {
            throw new RuntimeException('Refresh in progress, try later', 429);
        }

        try {
            // 1) 一次性 StateToken 校验
            $stored = Redis::get($stateKey);
            if (!$stored || $stored !== $deviceId) {
                throw new RuntimeException('Invalid state or device mismatch', 401);
            }
            Redis::del($stateKey);

            // 2) Refresh 令牌校验
            $userId = Redis::get("refresh:{$refreshToken}");
            if (!$userId) {
                throw new RuntimeException('Invalid or expired refresh token', 401);
            }

            // 3) 撤销式：删除旧 RefreshToken
            Redis::del("refresh:{$refreshToken}");

            // 4) 生成新令牌对
            $newAccess = JwtUtil::encode([
                'sub' => $userId,
                'iat' => time(),
                'exp' => time() + self::ACCESS_TTL,
                'type' => 'access',
            ]);
            $newRefresh = bin2hex(random_bytes(32));
            Redis::setex("refresh:{$newRefresh}", self::REFRESH_TTL, $userId);

            return compact('newAccess', 'newRefresh');
        } finally {
            Redis::del($lockKey);
        }
    }

    public function createRefreshState(string $deviceId): string
    {
        $state = bin2hex(random_bytes(16));
        Redis::setex("state:{$state}", self::STATE_TTL, $deviceId);
        return $state;
    }
}

<?php
// 网关/中间件示例（伪代码，可按 Webman/Laravel/Swoole 适配）
class TokenRenewMiddleware
{
    private const RENEW_THRESHOLD = 300; // 5分钟

    public function handle($request, $next)
    {
        $token = $this->extractToken($request);
        if (!$token) {
            return $next($request);
        }

        try {
            $payload = JwtUtil::decode($token);
        } catch (Exception $e) {
            return $this->unauthorized('Invalid token');
        }

        $remaining = $payload['exp'] - time();
        if ($remaining > self::RENEW_THRESHOLD) {
            return $next($request);
        }

        // 签发新令牌
        $newToken = JwtUtil::encode([
            'sub' => $payload['sub'],
            'iat' => time(),
            'exp' => time() + 900, // 15分钟
            'type' => 'access',
        ]);

        $response = $next($request);
        $response->withHeader('X-New-Token', $newToken);
        return $response;
    }

    private function extractToken($request): ?string
    {
        $auth = $request->header('Authorization', '');
        return str_starts_with($auth, 'Bearer ') ? substr($auth, 7) : null;
    }

    private function unauthorized(string $msg)
    {
        return new Response(401, ['Content-Type' => 'application/json'], json_encode(['error' => $msg]));
    }
}

<?php
class SessionService
{
    // 登录：单设备登录（踢旧）
    public function login(string $userId, string $deviceId): string
    {
        $token = JwtUtil::encode([
            'sub' => $userId,
            'iat' => time(),
            'exp' => time() + 900,
            'type' => 'access',
            'device' => $deviceId,
        ]);

        $key = "session:{$userId}:{$deviceId}";
        $oldToken = Redis::get($key);
        if ($oldToken) {
            // 使旧令牌失效（黑名单或缓存失效）
            Redis::setex("blacklist:{$oldToken}", 2100, '1');
        }
        Redis::setex($key, 900, $token);

        return $token;
    }

    // 跨服务验证：本地快速校验 + 认证中心兜底
    public function validateAcrossServices(string $token): bool
    {
        try {
            $payload = JwtUtil::decode($token);
            $key = "session:{$payload['sub']}:{$payload['device']}";
            $current = Redis::get($key);
            return $current && hash_equals($current, $token);
        } catch (Exception $e) {
            // 本地失败，调用认证中心兜底
            return AuthCenterClient::validate($token);
        }
    }
}