forked from luciferous/jwt
-
Couldn't load subscription status.
- Fork 1.3k
Open
Description
I've encountered an issue with base64 decoding in JWT::sign and JWT::verify. The sodium_crypto_* methods were rejecting the $key value for having an incorrect number of bytes.
The public key I was using containing URL-encoded characters, per the JWK RFC recommendations, and it seems like they are getting skipped by base64_decode.
It seems that ::sign and ::verify should be updated to use self::urlsafeB64Decode instead of base64_decode.
I am able to work around the issue by applying JWT::convertBase64UrlToBase64 to the public key strings before hydrating the Key objects.
Metadata
Metadata
Assignees
Labels
No labels