Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

verifyJWTClaims fails with single-value aud claim #441

Closed
osnard opened this issue Sep 17, 2024 · 0 comments · Fixed by #442
Closed

verifyJWTClaims fails with single-value aud claim #441

osnard opened this issue Sep 17, 2024 · 0 comments · Fixed by #442

Comments

@osnard
Copy link
Contributor

osnard commented Sep 17, 2024

This one is somehow connected to #333

aud - REQUIRED.
Audience(s) that this ID Token is intended for. It MUST contain the OAuth 2.0 client_id of the Relying Party as an audience value. It MAY also contain identifiers for other audiences. In the general case, the aud value is an array of case sensitive strings. In the special case when there is one audience, the aud value MAY be a single case sensitive string.

See https://openid.net/specs/openid-connect-basic-1_0-29.html#rfc.section.2.2

The current implementation at https://github.com/jumbojett/OpenID-Connect-PHP/blob/v1.0.2/src/OpenIDConnectClient.php#L1205 will break modern PHP versions with

TypeError: in_array(): Argument #2 ($haystack) must be of type array

in case $claims->aud !== $this->clientID but also $claims->aud not being an array.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant