Token constructor method should not throw if token has expired

TheNetworg / oauth2-azure

Azure AD provider for the OAuth 2.0 Client.

https://packagist.org/packages/thenetworg/oauth2-azure

MIT License

230 stars 108 forks source link

Token constructor method should not throw if token has expired #132

Open NPellet opened 3 years ago

NPellet commented 3 years ago

So I'm struggling a bit with the general workflow.

I'm trying to recreate the AccessToken from my PHP Session, but when the token is expired, the constructor throws a JWT\ExpiredException

which means I don't have access to the the hasExpired() method, and therefore also not to the refresh token. I can get it from the raw data, but if the implementation of the structure changes my code will break.

IMHO the constructor should not throw when the token is expired.

hajekj commented 2 years ago

I agree that this is definitely incorrect behavior and quite unfortunate. This change would require quite a complex change in the token validation scenario when you receive the token as a result of authorization flow. I will try to look into the ways to improve this.