ElyBy-Mirror/oauth2-server
1
0
Fork 0
mirror of https://github.com/elyby/oauth2-server.git synced 2024-12-22 21:19:46 +05:30
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #904 from dzibma/master

Browse Source 
Fix uncaught exception produced by unsigned token
This commit is contained in:
Andrew Millington 2018-05-22 18:13:17 +01:00 committed by GitHub
commit 2a7f671a95
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 9 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
CHANGELOG.md
View File

@ -6,6 +6,9 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
## [Unreleased] ## [Unreleased]
### Fixed
- Catch and handle `BadMethodCallException` from the `verify()` method of the JWT token in the `validateAuthorization` method (PR #904)
## [7.1.1] - released 2018-05-21 ## [7.1.1] - released 2018-05-21
### Fixed ### Fixed

4
src/AuthorizationValidators/BearerTokenValidator.php
View File

@ -65,9 +65,13 @@ class BearerTokenValidator implements AuthorizationValidatorInterface
try { try {
// Attempt to parse and validate the JWT // Attempt to parse and validate the JWT
$token = (new Parser())->parse($jwt); $token = (new Parser())->parse($jwt);
try {
if ($token->verify(new Sha256(), $this->publicKey->getKeyPath()) === false) { if ($token->verify(new Sha256(), $this->publicKey->getKeyPath()) === false) {
throw OAuthServerException::accessDenied('Access token could not be verified'); throw OAuthServerException::accessDenied('Access token could not be verified');
} }
} catch (\BadMethodCallException $exception) {
throw OAuthServerException::accessDenied('Access token is not signed');
}
// Ensure access token hasn't expired // Ensure access token hasn't expired
$data = new ValidationData(); $data = new ValidationData();