Signature verification failed

Hello all, I have a problem in verifying the following signature in php-jwt, it is successfully verified using jwt.io website, the problem appears just when I try to verify it using php-jwt.
I'm not sure if I missed something, could you tell me for any solution.

eyJhbGciOiAiSFMyNTYiLCJ0eXAiOiAiSldUIn0=.eyJ0aW1lIjoxNDI4OTQyMDcxLCJzdHIiOiJrYXJ0YWwiLCJsYW5ndWFnZSI6InRyIn0=.k4ZteQMHOs+43YxakNjuDfqevgFSmgwEykrgHxO1Uic=

[robertdimarco]

@ZeroTolerance Can you include some code for how you're verifying, and what results you're seeing?

[tuupola]

@ZeroTolerance if you edited the token in jwt.io website and it is signed using their default key 'secret' and not the key you have in PHP code.

@robertdimarco, @tuupola
Thanks for your replies.

$data = "eyJhbGciOiAiSFMyNTYiLCJ0eXAiOiAiSldUIn0=.eyJ0aW1lIjoxNDI4OTQyMDcxLCJzdHIiOiJrYXJ0YWwiLCJsYW5ndWFnZSI6InRyIn0=.k4ZteQMHOs+43YxakNjuDfqevgFSmgwEykrgHxO1Uic="
$api_key = 'secret'
$alg['alg'] = "HS256"

JWT::decode($data, $api_key, array($alg['alg']));

---

Later in code when I debugged code, I found that verifying signature throws an exception.

// Check the signature
if (!JWT::verify("$headb64.$bodyb64", $sig, $key, $header->alg)) {
      throw new \Exception('Signature verification failed');
 }

---

Notice : version = 2.0.0
I update decode function by adding a default value to $allowed_algs = array()

[lcabral37]

A quick notice, I did not manage to replicate this issue and I'm using PHP.5.5.9 which means I'm not using the hash_hmac() function so might this be an issue that occurs only for 5.6 (which will be using hash_hmac())?

Hi @lcabral37
Yes, I'm using the same version (PHP.5.5.9).

[robertdimarco]

I similarly couldn't reproduce this issue on PHP v5.5.23. @ZeroTolerance Does your snipper above manage to reproduce this reliably for you? Any insight that you could provide for us by digging into the JWT::verify() method?

[robertdimarco]

Closing due to inactivity, @ZeroTolerance feel free to contact again if you're able to repro and can provide add'l debugging information.

[u-clarkdeveloper]

Not sure if this helps, but I was using decode just fine, and then one day while making some changes I started to get that exception. Couldn't figure it out at first, then realized I had put in some debugging logic to loop through my $token to make sure I was setting it correctly. Well I stupidly put

foreach ($token as $key => $value) { do stuff }

So when I went to encode I was also using $key too, so my decode secret key stopped working because I was using a key from my token array. doh!

I figured out the problem, I just changed the following commented line with the next one.
Could you please confirm whether it is a valid solution or not.

public static function urlsafeB64Decode($input)
{
    $remainder = strlen($input) % 4;
    if ($remainder) {
        $padlen = 4 - $remainder;
        $input .= str_repeat('=', $padlen);
    }
    // return base64_decode(strtr($input, '-_', '+/'));
    return base64_decode(strtr($input, ' -_', '++/'));
}

[motin]

@ZeroTolerance Thanks! I can confirm that changing that line makes it work for me too. Was getting the invalid signature exception before, changed just that line and now it works great :)
php-jwt 2.2.0, PHP 5.6.9

[motin]

However, I also tried php-jwt 3.0.0 pristine and the issue was apparently solved by other means, did not have to do any modifications.

[doapp-ryanp]

I had similar issue #87 fixed it for me

[wangel12]

In mY case, when i sub_str the Authorization header, there was a space before the JWT. So it was not working that way. Later i did subtracting one more space, and it worked. So it means that before JWT string, there should not be any spaces or the signature verification will throw error, however note that it will work in the jwt.io page when i tried to test it there