Merge pull request #904 from dzibma/master

Fix uncaught exception produced by unsigned token

CHANGELOG.md

@@ -6,6 +6,9 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 
 ## [Unreleased]
 
+### Fixed
+- Catch and handle `BadMethodCallException` from the `verify()` method of the JWT token in the `validateAuthorization` method (PR #904)
+
 ## [7.1.1] - released 2018-05-21
 
 ### Fixed

src/AuthorizationValidators/BearerTokenValidator.php

@@ -65,9 +65,13 @@ class BearerTokenValidator implements AuthorizationValidatorInterface
         try {
             // Attempt to parse and validate the JWT
             $token = (new Parser())->parse($jwt);
+            try {
                 if ($token->verify(new Sha256(), $this->publicKey->getKeyPath()) === false) {
                     throw OAuthServerException::accessDenied('Access token could not be verified');
                 }
+            } catch (\BadMethodCallException $exception) {
+                throw OAuthServerException::accessDenied('Access token is not signed');
+            }
 
             // Ensure access token hasn't expired
             $data = new ValidationData();