Using lcobucci/jwt v4.0 breaks iat claim

[tsdevelopment]

I think this issued could be almost the same as #803

public function onJWTCreated(JWTCreatedEvent $event)
{
    $payload['iat'] = time() - 15;
    $event->setData($payload);
}

Gives
Builder#withClaim() is meant to be used for non-registered claims, check the documentation on how to set claim "iat"

[chalasr]

Thank you for the report, I'm going to release a fix for this in the next couple of days.

[Ocramius]

Similar issue over here: the problem happens in

LexikJWTAuthenticationBundle/Services/JWSProvider/LcobucciJWSProvider.php

Lines 100 to 144 in f6c0d9a

	public function create(array $payload, array $header = [])
	{
	if (class_exists(JWTBuilder::class)) {
	$jws = new JWTBuilder(new JoseEncoder(), new MicrosecondBasedDateConversion());
	} else {
	$jws = new Builder();
	}
	foreach ($header as $k => $v) {
	$jws->{$this->legacyJWTApi ? 'setHeader' : 'withHeader'}($k, $v);
	}
	$now = time();
	if ($this->legacyJWTApi) {
	$jws->setIssuedAt($now);
	} else {
	$jws->issuedAt($this->useDateObjects ? new \DateTimeImmutable("@{$now}") : $now);
	}
	if (null !== $this->ttl || isset($payload['exp'])) {
	$exp = isset($payload['exp']) ? $payload['exp'] : $now + $this->ttl;
	unset($payload['exp']);
	if ($this->legacyJWTApi) {
	$jws->setExpiration($exp);
	} else {
	$jws->expiresAt($exp instanceof \DateTimeImmutable ? $exp : ($this->useDateObjects ? new \DateTimeImmutable("@$exp") : $exp));
	}
	}
	if (isset($payload['sub'])) {
	$jws->{$this->legacyJWTApi ? 'setSubject' : 'relatedTo'}($payload['sub']);
	unset($payload['sub']);
	}
	if (interface_exists(RegisteredClaims::class)) {
	$this->addStandardClaims($jws, $payload);
	}
	foreach ($payload as $name => $value) {
	if ($this->legacyJWTApi) {
	$jws->set($name, $value);
	} else {
	$jws->{method_exists($jws,'with') ? 'with' : 'withClaim'}($name, $value);

Specifically, this line leads to the crash:

LexikJWTAuthenticationBundle/Services/JWSProvider/LcobucciJWSProvider.php

Line 144 in f6c0d9a

$jws->{method_exists($jws,'with') ? 'with' : 'withClaim'}($name, $value);

If 'iat' is passed as one of the values of the token, this crashes.

A relatively simplistic way to verify this is by decoding a token, extracting its data (which will contain "iat") and then re-encoding it: that leads to a crash.

[chalasr]

Thanks for the helpful details. Fix released in v2.10.6

[Ocramius]

Thanks @chalasr \o/