firebase / php-jwt

PHP package for JWT
BSD 3-Clause "New" or "Revised" License
9.3k stars 1.26k forks source link

use microtime(true) instead of time() for the JWT validation #523

Open bshaffer opened 1 year ago

bshaffer commented 1 year ago

See https://github.com/firebase/php-jwt/issues/488 and https://github.com/firebase/php-jwt/pull/492

use microtime instead of time for JWT validation.

We MAY want to do this in a minor version because it's possible that gettimeofday (which is required by microtime) doesn't exist on all systems. It may be possible to verify that the function does exist, and fall back on date if not.