search

TheNetworg / oauth2-azure

Azure AD provider for the OAuth 2.0 Client.
https://packagist.org/packages/thenetworg/oauth2-azure
MIT License
229 stars 108 forks source link

Firebase 6 #159

Closed rothkj1022 closed 2 years ago

rothkj1022 commented 2 years ago

Allows firebase 6.x to be installed and fixes insecure encryption issue.

firebase/php-jwt@5.5.1 is vulnerable to Insecure Encryption due to an algorithm-confusion issue (e.g., RS256 / HS256) that exists via the kid (aka Key ID) header when multiple types of keys are loaded in a key ring. This allows an attacker to forge tokens that validate under the incorrect key. This vulnerability is fixed in firebase/php-jwt@6.0.0.

Screen Shot 2022-05-02 at 5 00 19 PM

hajekj commented 2 years ago

Thanks for the PR!

curry684 commented 2 years ago

I tested this in my production project today which completely relies on Azure authentication, and found no issues. As far as I'm concerned the release can be tagged.