php-jwt
php-jwt copied to clipboard
Support at+jwt access token type
https://github.com/miladrahimi/php-jwt/blob/6555d0d46b396436e5bf64fbc2cecc78ba5c6f27/src/Parser.php#L154
This code line will throw an exception when any other JTW type besides "jwt" is found. This RFC https://datatracker.ietf.org/doc/html/rfc9068 registers the type "at+jwt" for OAuth2 access tokens and I think this library should be able to validate them.
Section 4 of the RFC outlines the validation steps needed, which seems to be pretty much in line with what this library does anyway:
- validate signature
- validate ISS
- validate AUD
- validate EXP
In case the access token is encrypted, it would need to be decrypted, same holds for type "jwt". What do you think?