Fix exception when iss is missing

Author: samuelwei

src/OpenIDConnectClient.php

@@ -527,7 +527,7 @@ public function verifyLogoutTokenClaims($claims): bool
         }
 
         // Validate the iss
-        if (!$this->validateIssuer($claims->iss)) {
+        if (!isset($claims->iss) || !$this->validateIssuer($claims->iss)) {
             return false;
         }
         // Validate the aud
@@ -1208,7 +1208,7 @@ protected function verifyJWTClaims($claims, ?string $accessToken = null): bool
         }
         $auds = $claims->aud;
         $auds = is_array( $auds ) ? $auds : [ $auds ];
-        return (($this->validateIssuer($claims->iss))
+        return ((isset($claims->iss) && $this->validateIssuer($claims->iss))
             && (in_array($this->clientID, $auds, true))
             && ($claims->sub === $this->getIdTokenPayload()->sub)
             && (!isset($claims->nonce) || $claims->nonce === $this->getNonce())

tests/OpenIDConnectClientTest.php

@@ -63,6 +63,13 @@ public function getIdTokenPayload()
             'iss' => 'issuer',
         ]);
         self::assertFalse($valid);
+
+        # missing iss
+        $valid = $client->testVerifyJWTClaims((object)[
+            'aud' => 'client-id',
+            'sub' => 'sub',
+        ]);
+        self::assertFalse($valid);
     }
     public function testJWTDecode()
     {
@@ -336,6 +343,18 @@ public function provideTestVerifyLogoutTokenClaimsData(): array
                 ],
                 false
             ],
+            'invalid-no-iss' => [
+                (object)[
+                    'aud' => [ 'fake-client-id', 'some-other-aud' ],
+                    'sub' => 'fake-client-sub',
+                    'sid' => 'fake-client-sid',
+                    'iat' => time(),
+                    'events' => (object) [
+                        'http://schemas.openid.net/event/backchannel-logout' => (object)[]
+                    ],
+                ],
+                false
+            ],
         ];
     }
 }