Ensure allowed algorithms list is overwritten instead of merged.

Closes #52, #54.
ADmad · May 31, 2017 · a9c7317 · a9c7317
1 parent b49fbc9
commit a9c7317
Show file tree

Hide file tree

Showing 2 changed files with 18 additions and 1 deletion.
diff --git a/src/Auth/JwtAuthenticate.php b/src/Auth/JwtAuthenticate.php
@@ -91,13 +91,16 @@ public function __construct(ComponentRegistry $registry, $config)
             'header' => 'authorization',
             'prefix' => 'bearer',
             'parameter' => 'token',
-            'allowedAlgs' => ['HS256'],
             'queryDatasource' => true,
             'fields' => ['username' => 'id'],
             'unauthenticatedException' => '\Cake\Network\Exception\UnauthorizedException',
             'key' => null,
         ]);
 
+        if (empty($config['allowedAlgs'])) {
+            $config['allowedAlgs'] = ['HS256'];
+        }
+
         parent::__construct($registry, $config);
     }
 

diff --git a/tests/TestCase/Auth/JwtAuthenticateTest.php b/tests/TestCase/Auth/JwtAuthenticateTest.php
@@ -44,6 +44,20 @@ public function setUp()
             ->getMock();
     }
 
+    /**
+     * testConfig.
+     *
+     * @return void
+     */
+    public function testConfig()
+    {
+        $auth = new JwtAuthenticate($this->Registry, [
+            'allowedAlgs' => ['RS256']
+        ]);
+
+        $this->assertEquals(['RS256'], $auth->config('allowedAlgs'));
+    }
+
     /**
      * test authenticate token as query parameter.
      *