Add support for a JWT "jti" value to prevent replay attacks

pdsinterop / solid-nextcloud

A plugin to make Nextcloud compatible with Solid

https://pdsinterop.org/solid-nextcloud/

MIT License

72 stars 11 forks source link

Closed Potherca closed 2 years ago

Potherca commented 2 years ago

This MR updates the php-solid-auth lib to the latest version (which includes JTI validation) and adds an implementation for JTI storage.

this is done by adding a database table (to store JTIs) and a factory trait (to prevent code duplication).

This branch needs to be tested before this MR can move out of draft.

Closes #84

Potherca commented 2 years ago

Currently, the build breaks for the Solid CRUD tests. This seems to be related to the more stringent validation of JWT / JKT / DPOP.

Researching where the breakage is coming from with @ylebre and @poef.