Comments (9)
Hi Thanks for the question,
The library imposes strict secrets to increase the minimal level of security JWTs offer as it is relatively easy to crack a JWT if the secret is weak.
I would ask why your secret / secrets are only alphanumeric,, how are you generating them?
If you wish to amend this functionality you can extend the validation class and override the secret method... https://github.com/RobDWaller/ReallySimpleJWT/blob/master/src/Validate.php#L88
Then inject this new validation class into the Parse class.
I hop that makes sense and let me know if you have any other questions.
Cheers, Rob
from reallysimplejwt.
The secret
is generated by the 3rd party API provider. I don't have control over this.
I'm not sure if it's used for more things than the JWT secret so maybe it can't contain symbols.
I've extended the Validate class and overwritten the secret()
method and then passed it into the Builder/Parser. It seems to be working locally but I'll give it a proper check over soon.
Thanks for you time/help Rob and I really appreciate the flexibility of this library!
from reallysimplejwt.
No worries, I'll have a think about how this issue can be solved sensibly in a future release.
from reallysimplejwt.
@RobDWaller Hi Rob, I have the same issue, so I've extended the Validate class and overwritten the secret() method, but how can I inject this new validation class into the Parse class?
Can you please provide a code example?
from reallysimplejwt.
In my main file I call the lib like this;
use ReallySimpleJWT\Exception\ValidateException;
use ReallySimpleJWT\Token;
if (!class_exists('\ReallySimpleJWT\Token')) {
require ABSPATH . 'vendor/autoload.php';
}
include_once('JWT-class-override.php');
and the JWT-class-override.php
looks like this;
<?php
/*
* We overwrite the secret method from ReallySimpleJWT\Validate
* This is because the ReallySimpleJWT library expects symbols and such in the `secret` and Credit Kudos don't provide that.
*/
class CustomValidate extends ReallySimpleJWT\Validate
{
public function secret(string $secret): bool
{
return true;
}
}
In the main file I then call the Build()
myself like this;
$builder = new ReallySimpleJWT\Build('JWT', new CustomValidate(), new ReallySimpleJWT\Encode());
This is where the CustomValidate()
from JWT-class-override.php
is used instead of the default one :)
This seems to work fine for me, hopefully it's helpful for you too.
from reallysimplejwt.
The old code was simple with $token = Token::customPayload($payload, $secret);
but now I need to do $token = customPayload($payload, $secret);
where customPayload
is defined like this;
/**
*
* This is a really hacky fix but there is a problem with the library secret validation been too aggressive.
* I've overridden the Validation class with a custom ->secret() and we pass this into the Builder/Parser.
*
* It should continue to work well but it's just messy.
*
* @param $payload
* @param $secret
* @return string
* @throws ValidateException
*/
function customPayload($payload, $secret) {
$builder = new ReallySimpleJWT\Build('JWT', new CustomValidate(), new ReallySimpleJWT\Encode());
foreach ($payload as $key => $value) {
if (is_int($key)) {
throw new ValidateException('Invalid payload claim.', 8);
}
$builder->setPayloadClaim($key, $value);
}
return $builder->setSecret($secret)
->build()
->getToken();
}
from reallysimplejwt.
Guys I'm really sorry for the slow response to this stuff. Been very busy, I'll try to add some extra documentation or a code improvement.
from reallysimplejwt.
Just an update on this, I'm hoping version 3.0 should provide an adequate solution to this problem. Should be released in Feb I hope.
from reallysimplejwt.
So I've now released version 3.0.0 of this package which should solve this problem now. See the amended documentation.
https://github.com/RobDWaller/ReallySimpleJWT#custom-secrets
from reallysimplejwt.
Related Issues (20)
- PHP Version Required? HOT 1
- 500 Internal Server Error HOT 2
- jsonDecode method can return null HOT 1
- Only Works With PHP 7.1 HOT 1
- Installation HOT 2
- Fix syntax errors in README
- Audience validation? HOT 1
- Proposal: Add support for KID claim HOT 5
- Why i can't use my own JWT secret? HOT 5
- Secret Fixed Length
- How can I reduce length of JWT TOKEN HOT 1
- nbf not set when creating simple but then validates HOT 3
- Documentation incorrect HOT 5
- Get payload without the token secret like on jwt.io? HOT 1
- Validate->notBefore should allow same sec timestamp HOT 2
- Destroying the active token HOT 1
- "Call to undefined method ReallySimpleJWT\Token::validateExpiration()" HOT 2
- support for H512
- Private - Public Key Encryption Support ??
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from reallysimplejwt.