Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Doc] Documentation differs with real execution #11

Open
scaytrase opened this issue Feb 22, 2016 · 0 comments
Open

[Doc] Documentation differs with real execution #11

scaytrase opened this issue Feb 22, 2016 · 0 comments

Comments

@scaytrase
Copy link

Readme says that

To verify a token's claims, first set up the context that should be used to verify the token against. Encryption is the only required verification.

$context = new Emarref\Jwt\Verification\Context($encryption);
$context->setAudience('audience_1');
$context->setIssuer('your_issuer');

But looking inside the algo - this code quietly implies and verifies that sub should be null. Also with some other claims - code user should explicitly set the correct value from token if he do not want these to fail on verification.

I'm missing something maybe, but I thought that claims are not subject of mandatory verification if they are present.

As a decision I suggest to move the contents of the getVerifiers method to be the third argument of Jwt::verify method and push EncryptionVerifier there internally as only mandatory verifier. This will also make the verifier list extensible without extending Jwt class, allowing to verify custom claims.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant