do not escape slashes in json_encoding of jwt components

[nsfinkelstein]

Currently when we sign JWTs, we get JSON representations of the HEADER and PAYLOAD, and we escape slashes in that json encoding.

This is problematic because if the payload is originally base64 encoded without escaped slashes, then verification of that JWT will fail.

If the JWT is generated using this library, then there is no problem because the slashes are escaped before the JWT the header and payload are base64 encoded as well. However, while using this library in conjunction with other code that does not escape slashes before base64 encoding the payload and header, verification will fail.

I can see no reason to escape slashes. This is a pull request to stop escaping slashes in the JWT head and payload before base64 encoding them to be signed.

[odino]

hey @n-s-f, thanks for this! Though Im not sure i entirely understood the original issue -- would you mind adding a test case for that?

[odino]

ping @n-s-f :)

[nsfinkelstein]

@odino

Thanks for getting to me!

Here's the issue:

Let's say I have a payload of:

{
   'iss': 'Y/Y/Y', 
   'aud': 'X/X/X'
}

Then, when I load my JWS from the base64url encoded token, I will get a php array:

[
   'iss' => 'Y/Y/Y',
   'aud' => 'X/X/X
]

Now, when I go verify the signature, I need to json_encode the payload again to regenerate the base64url encoded string that was signed. But now, I get:

{
   'iss': 'Y\/Y\/Y', 
   'aud': 'X\/X\/X'
}

When I generate a base64url encoded token from that JSON, it naturally turns out differently than the token generated from the original JSON, which is the token that was originally signed.

Therefore, verification fails.

This does not present itself as a problem when using this library to verify JWTs generated by this library, because the same lines of code I change in this pull request also escape slashes the JSON before the base64url encoded token is generated to be signed.

However, as demonstrated, verification fails if the JWT is created with JSON that includes slashes in a language that does not auto-escape slashes upon JSON encoding (i.e. any other language).

I have added a test to demonstrate the issue. Without my patch, the test I've added would fail.

Thanks very much!
Noam

[odino]

👍

[odino]

it's in 6.0.0. Updated the major version as an earlier commit dropped support for php 5.3 :)

[nsfinkelstein]

@odino Thanks!