Do we really need to throw an exception when verifying the signature of an unsigned token?

[lcobucci]

I thinking that just returning false would be good enough and will simplify the code of library users.

Instead of doing:

try {
    if (!$token->verify($signer, $key) || !$token->validate($data)) {
        // do something to tell that the token is unacceptable.
    }
} catch (\BadMethodCallException $e) {
    // do something to tell that the token is unacceptable.
}

Users could do:

if (!$token->verify($signer, $key) || !$token->validate($data)) {
    // do something to tell that the token is unacceptable.
}

Any thoughts?

[Ocramius]

Agreed: no signature or invalid signature are equivalent, from a functional standpoint.

[ricardofontanelli]

Hello guys,
Any news about this feature?

[lcobucci]

Hey @ricardofontanelli this will be implemented for v4. Soon I'll be working on it 😄