You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
But looking inside the algo - this code quietly implies and verifies that sub should be null. Also with some other claims - code user should explicitly set the correct value from token if he do not want these to fail on verification.
I'm missing something maybe, but I thought that claims are not subject of mandatory verification if they are present.
As a decision I suggest to move the contents of the getVerifiers method to be the third argument of Jwt::verify method and push EncryptionVerifier there internally as only mandatory verifier. This will also make the verifier list extensible without extending Jwt class, allowing to verify custom claims.
The text was updated successfully, but these errors were encountered:
Readme says that
But looking inside the algo - this code quietly implies and verifies that
sub
should be null. Also with some other claims - code user should explicitly set the correct value from token if he do not want these to fail on verification.I'm missing something maybe, but I thought that claims are not subject of mandatory verification if they are present.
As a decision I suggest to move the contents of the
getVerifiers
method to be the third argument ofJwt::verify
method and pushEncryptionVerifier
there internally as only mandatory verifier. This will also make the verifier list extensible without extendingJwt
class, allowing to verify custom claims.The text was updated successfully, but these errors were encountered: