Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Using lcobucci/jwt v4.0 breaks jti claim #803

Closed
Warrows opened this issue Nov 30, 2020 · 4 comments · Fixed by #804
Closed

Using lcobucci/jwt v4.0 breaks jti claim #803

Warrows opened this issue Nov 30, 2020 · 4 comments · Fixed by #804

Comments

@Warrows
Copy link
Contributor

Warrows commented Nov 30, 2020

I've been using this bundle for some time now. Trying to set it up on a new project I get everything fresh and copy some old code of mine.
Turns out using lcobucci/jwt v4.0 breaks the jti claim set through payload.

    public function onJWTCreated(JWTCreatedEvent $event)
    {
        $request = $this->requestStack->getCurrentRequest();
        $payload['token_type']     = 'access';
        $payload['jti']            = uniqid();
        $event->setData($payload);
    }

Gives

Lcobucci\JWT\Token\
RegisteredClaimGiven
Builder#withClaim() is meant to be used for non-registered claims, check the documentation on how to set claim "jti"

I haven't looked too far into it. But at first glance I think the best way to fix this would be either to:

Other registered claims will certainly need the same kind of treatement. In the meantime, I'll avoid v2.10.1

@chalasr
Copy link
Collaborator

chalasr commented Nov 30, 2020

Just released v2.10.2 which ships a fix for this (#801). Can you please confirm it works for you?

@Warrows
Copy link
Contributor Author

Warrows commented Nov 30, 2020

It doesn't seem to work.
Afforementionned error is still returned.
Stack goes through
lcobucci\jwt\src\Token\Builder.php (line 85)
lexik\jwt-authentication-bundle\Services\JWSProvider\LcobucciJWSProvider.php (line 137) : $jws->{method_exists($jws,'with') ? 'with' : 'withClaim'}($name, $value);

@chalasr
Copy link
Collaborator

chalasr commented Nov 30, 2020

Sorry, it should be ok with #804 (I used your test case), thanks for trying.
I'm going to release v2.10.3 once the CI is green.

chalasr added a commit that referenced this issue Nov 30, 2020
…d (bis) (chalasr)

This PR was merged into the 2.x-dev branch.

Discussion
----------

Fix ability to set extra standard claims in the input payload (bis)

Fixes #803

Commits
-------

61a22d8 Fix ability to set extra standard claims in the input payload (bis)
@Warrows
Copy link
Contributor Author

Warrows commented Dec 1, 2020

Works like a charm. Thank you very much.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
2 participants