3.10.6

PhalconKit Core 3.10.6 fixes JWT validation enforcement in the identity manager. Applications using the inherited JWT identity flow should upgrade from 3.10.5.

Security fix

The identity consumer previously called the JWT validator but ignored its returned errors, then decoded and trusted the subject. Invalid access tokens could therefore reach identity lookup, and invalid refresh tokens could rotate an existing session and issue replacement credentials.

Identity now rejects expired tokens, invalid signatures, access/refresh token substitution, incorrect issuer/audience/id, future time claims, and malformed credentials with a generic HTTP 401 before trusting the subject or performing session and token-issuance operations. Invalid credentials cannot fall through to PHP session authentication.

The API error controller renders these failures without re-entering identity resolution, including when debug output or response caching is enabled. It omits authentication debug context and marks the response uncacheable.

Upgrade notes

• Upgrade phalcon-kit/core to ^3.10.6 through Composer and commit the application lockfile.
• Send refresh requests with refreshToken and omit expired access credentials from the request/header. Omit stale invalid JWTs during login as well. On refresh rejection, discard unusable client credentials and require login.
• Overrides of session persistence alone inherit the fix. Review custom getClaimFromToken() implementations and HTTP error handlers: enforce validation, preserve 401, and do not expose tokens or validator diagnostics.
• The low-level validateToken() API still returns an error array. Every consumer must reject non-empty results.
• Token format, signing settings, lifetimes, clock allowances, idle/absolute session policies, and existing refresh-source precedence are unchanged. This is not a refresh-token-only policy or a revocation mechanism for otherwise valid tokens.
• A separate existing stateless logoutAs() merge issue is tracked in the discussion guide and is outside this release's JWT enforcement fix.

Full consumer guidance

Validation

Regression coverage uses the actual core identity consumers and native Phalcon JWT validation with synthetic signing keys and isolated storage. It covers access authentication, refresh rejection without session mutation or replacement token issuance, PHP-session fallback, stateless identity, persistence overrides, and the HTTP dispatcher.

The release is validated with Composer checks, PHPUnit, PHPStan, Psalm, Psalm taint analysis, PHPCS, package skeleton validation, regenerated API documentation, a complete MkDocs build, and package archive review.

Compare 3.10.5...3.10.6