Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Support at+jwt access token type #25

Open
ronnybremer opened this issue Jun 19, 2024 · 0 comments
Open

Support at+jwt access token type #25

ronnybremer opened this issue Jun 19, 2024 · 0 comments

Comments

@ronnybremer
Copy link

if ($fields['typ'] !== 'JWT') {

This code line will throw an exception when any other JTW type besides "jwt" is found.
This RFC https://datatracker.ietf.org/doc/html/rfc9068 registers the type "at+jwt" for OAuth2 access tokens and I think this library should be able to validate them.

Section 4 of the RFC outlines the validation steps needed, which seems to be pretty much in line with what this library does anyway:

  • validate signature
  • validate ISS
  • validate AUD
  • validate EXP

In case the access token is encrypted, it would need to be decrypted, same holds for type "jwt". What do you think?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant