jwt
jwt copied to clipboard
emarref
json_encode method should use unescaped slashes
Some of our "sub" claims contain forward slashes. I noticed that when the signature is verified and the unsigned value is generated, the json_encode function was adding backslashes to the subject.
I think the proper way to handle this would be to use "return json_encode($properties, JSON_UNESCAPED_SLASHES);"
Hi, thanks for opening this issue. We are aware of this problem after diagnosing and discussing it in #21. Will track the progress here.
@emarref you're having these issues here because this lib recreates the payload to verify the token. And slashes won't be your only problem since JSON encoding varies a lot - specially across different languages.
My advice is to always generate a small JSON string but allow the library to accept some weird stuff (like spaces after :, escaping or even a pretty JSON string).
On lcobucci/jwt I've solved this by saving the original encoded string, maybe you can do the same 😉
Yeah, I realise that. My plan on #23 was to disable slashes by default, but allow them using options.
However your point about how much JSON encoding can differ is the reason I haven't completed this branch.
Saving the original encoded string looks like the best way to do it, thanks for the tip.