oauth2-server-php icon indicating copy to clipboard operation
oauth2-server-php copied to clipboard

[Fix test] "Expiration (exp) time must be a unix time stamp" on 32-bit platform

Open afilippov1985 opened this issue 8 years ago • 1 comments

After this PR #898 I able to run tests. And I get:

There were 2 failures:

1) OAuth2\GrantType\JwtBearerTest::testInvalidJti
Failed asserting that two strings are equal.
--- Expected
+++ Actual
@@ @@
-'Expiration (exp) time must be a unix time stamp'
+'JSON Token Identifier (jti) has already been used'

D:\eclipseworkspace\oauth2-server-php\test\OAuth2\GrantType\JwtBearerTest.php:291

2) OAuth2\GrantType\JwtBearerTest::testJtiReplayAttack
Failed asserting that null is not null.

Tests failed because ctype_digit($jwt['exp']) evals to false when $jwt['exp'] is double (it becomes double when $jwt['exp'] > PHP_INT_MAX)

// on 32-bit
$d = 99999999900;
var_dump($d, ctype_digit($d));
//double(99999999900) bool(false) 

$d = '99999999900';
var_dump($d, ctype_digit($d));
//string(11) "99999999900" bool(true) 

// on 64-bit
$d = 99999999900;
var_dump($d, ctype_digit($d));
//int(99999999900) bool(true) 

$d = '99999999900';
var_dump($d, ctype_digit($d));
//string(11) "99999999900" bool(true) 

To fix this we should always write big integers as strings ('99999999900') or write integers as integers (12345) and integers must be <= PHP_INT_MAX

afilippov1985 avatar Dec 06 '17 07:12 afilippov1985

Thanks, I did not really test this library for 32 bit. My deepest regrets that you are dealing with such.

bshaffer avatar Jul 03 '19 16:07 bshaffer