-
Notifications
You must be signed in to change notification settings - Fork 13
Open
Description
Checking if authorizedParies is null when the type of the param is always an array is wrong.
Because an empty array in php is different from null.
This
$options->getAuthorizedParties() !== null means [] !==null
Which an empty array is not null.
So eventhought i have not passed an authorizedParty to check my jwt it will still try to validate it, and i will get an error message
Authorized party claim (azp) does not match any of the authorized parties.
I suggest adding another condition for extra security
$options->getAuthorizedParties() !== null && $options->getAuthorizedParties() !== []
| if ($options->getAuthorizedParties() !== null) { |
Metadata
Metadata
Assignees
Labels
No labels