Add TokenVerifier for non-OIDC-compliant JWTs #428
Conversation
| { | ||
|
|
||
| /** |
There was a problem hiding this comment.
All checks, properties, and methods were moved to TokenVerifier
| @@ -0,0 +1,163 @@ | |||
| <?php | |||
There was a problem hiding this comment.
Everything here was previously in IdTokenVerifier
| $verifier = new IdTokenVerifier('__test_iss__', uniqid(), new SymmetricVerifier('__test_secret__')); | ||
| $builder = (new Builder())->issuedBy('__test_iss__'); | ||
| $verifier = new IdTokenVerifier('__test_iss__', '__test_aud__', new SymmetricVerifier('__test_secret__')); | ||
| $builder = (new Builder()) |
There was a problem hiding this comment.
Tests changed because the standard JWT claims are now verified before the ID-token specific ones.
src/Helpers/Tokens/TokenVerifier.php
Outdated
| } | ||
|
|
||
| /** | ||
| * Verifies and decodes an JWT. |
There was a problem hiding this comment.
Nit: grammar
| * Verifies and decodes an JWT. | |
| * Verifies and decodes a JWT. |
src/Helpers/Tokens/TokenVerifier.php
Outdated
| * @param array $options Options to adjust the verification. Can be: | ||
| * - "nonce" to check the nonce contained in the token (recommended). | ||
| * - "max_age" to check the auth_time of the token. | ||
| * - "time" Unix timestamp to use as the current time for exp, iat, and auth_time checks. Used for testing. |
There was a problem hiding this comment.
Question: is this typically something we want to highlight as an option in the docs and right there in the editor? Wouldn't it make it more visible and thus more likely someone could use this to manipulate the validator?
There was a problem hiding this comment.
Either way, if the documentation is to remain, it doesn't look like iat and auth_time are being checked here. Looks like those checks have been left in the subclass.
|
This pull request has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs. |
Description
Adds a generic JWT verifier class,
TokenVerifier, whichIdTokenVerifiernow extends.References
Testing
Checklist
Note: documentation will need to come after v7.1.0 of this library is released. PR:
auth0/docs#8765
master