miladrahimi / php-jwt

A PHP implementation of JWT (JSON Web Token) generator, parser, verifier, and validator.

Milad Rahimi

php-jwt's Issues

Invalid key exception, while private and public key is there

Hey, can you please help me? i found this error with NULL message

I use on Codeigniter and Windows OS, i'm little bit confused because in my MacOs, it's worked, and i dont change anything on the source code and the .pem file of public and private key.

Support at+jwt access token type

php-jwt/src/Parser.php

Line 154 in 6555d0d

if ($fields['typ'] !== 'JWT') {

This code line will throw an exception when any other JTW type besides "jwt" is found.
This RFC https://datatracker.ietf.org/doc/html/rfc9068 registers the type "at+jwt" for OAuth2 access tokens and I think this library should be able to validate them.

Section 4 of the RFC outlines the validation steps needed, which seems to be pretty much in line with what this library does anyway:

• validate signature
• validate ISS
• validate AUD
• validate EXP

In case the access token is encrypted, it would need to be decrypted, same holds for type "jwt". What do you think?

SUPPORT FOR PS256 ALGORITHM

ADD SUPPORT FOR PS256 ALGORITHM

Have the various exceptions inherit from a single exception type

Right now all the exceptions inherit from \Exception. This means I have no way to catch specifically exceptions from this library, other than catching each separate possible exception type, and that's not maintainable.

If you had a (possibly abstract) base exception class and had all your other exceptions inherit from that, my error handling could be simpler, since I could catch that parent exception type.

Allow keys to be instantiated from strings rather than only from files

I am grabbing the public key I want to verify a token against from the web. Currently as far as I can tell with this library I'd need to save that to a file in order to pass that file path into RsaPublicKey's constructor.

It'd be nice if I didn't need to do that middle step.

I'm a little confused about why the current behaviour is as it is, given how openssl_pkey_get_public works -- its docs say that it supports various formats of inputs including a PEM string like I have or a filename in the format file://path/to/file.pem already, among a couple of others, so why not pass an argument straight through?

Wrong condition

Exp must be newer than now

php-jwt/src/Validator/DefaultValidator.php

Line 21 in 333b2db

$this->addRule(PublicClaimNames::EXPIRATION_TIME, new NewerThan(time()));

but your NewerThan has incorrect behavior

php-jwt/src/Validator/Rules/Required/GreaterThan.php

Line 32 in 333b2db

return $exists && $this->number > $value;

Result: time() > exp, must be exp > time()