jumbojett / OpenID-Connect-PHP

Minimalist OpenID Connect client
https://github.com/jumbojett/OpenID-Connect-PHP
Apache License 2.0
612 stars 366 forks source link

Unable to verify JWT claims #298

Open kudamhazo opened 2 years ago

kudamhazo commented 2 years ago

There is a bit of an issue with the validation of datetimes (exp, iat, nbf, etc) claims. The library is checking if they are integers which is not correct. It should check if they are numeric (maybe is_numeric(...)method) instead because the RFC ref for JWT does not restrict those claims to integers. I am experiencing some challenges because of this issue. OpenID server I am using returns claims with format like this:

{
  "iat": 1648944303.697052,
  "exp": 1680480303.583767,
}

Hope this can be updated some time. Here is the code reference to where the issue is: https://github.com/jumbojett/OpenID-Connect-PHP/blob/4ac6b24ad4a011017ebea0fbad6aa5be4457cc9a/src/OpenIDConnectClient.php#L1072-L1073

kudamhazo commented 2 years ago

I can take a stab at PR if you think this is worth fixing 🙂