Skip to content

Commit 2e6ddd9

Browse files
samuelweisamuelwei
authored
Merge branch 'master' into SamuelWei-verify-iss
2 parents ee3cdae + bc719cc commit 2e6ddd9

File tree

3 files changed

+66
-4
lines changed

3 files changed

+66
-4
lines changed

‎CHANGELOG.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,12 +6,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
66

77
## [unreleased]
88

9+
### Added
10+
- Support to change the `leeway` time for JWT verification using `setLeeway` #483
11+
912
### Changed
1013
- Stop adding ?schema=openid to userinfo endpoint URL. #449
1114

1215
### Fixed
1316
- Check existence of subject when verifying JWT #474
1417
- Check existence of issuer before validating #477
18+
- exp verification when verifying Logout Token claims #482
1519

1620
## [1.0.1] - 2024-09-13
1721

‎src/OpenIDConnectClient.php‎

Lines changed: 14 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -536,12 +536,17 @@ public function verifyLogoutTokenClaims($claims): bool
536536
if (!in_array($this->clientID, $auds, true)) {
537537
return false;
538538
}
539-
// Validate the iat. At this point we can return true if it is ok
540-
if (isset($claims->iat) && ((is_int($claims->iat)) && ($claims->iat <= time() + $this->leeway))) {
541-
return true;
539+
// Validate iat exists, is an int, and is not in the future
540+
if (!isset($claims->iat) || !is_int($claims->iat) || ($claims->iat >= time() + $this->leeway)) {
541+
return false;
542542
}
543543

544-
return false;
544+
// Validate exp exists, is an int, and is not too old
545+
if (!isset($claims->exp) || !is_int($claims->exp) || ($claims->exp <= time() - $this->leeway)) {
546+
return false;
547+
}
548+
549+
return true;
545550
}
546551

547552
/**
@@ -2030,6 +2035,11 @@ public function getLeeway(): int
20302035
return $this->leeway;
20312036
}
20322037

2038+
public function setLeeway(int $leeway)
2039+
{
2040+
$this->leeway = $leeway;
2041+
}
2042+
20332043
/**
20342044
* @return string
20352045
*/

‎tests/OpenIDConnectClientTest.php‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -232,6 +232,7 @@ public function provideTestVerifyLogoutTokenClaimsData(): array
232232
'sid' => 'fake-client-sid',
233233
'sub' => 'fake-client-sub',
234234
'iat' => time(),
235+
'exp' => time() + 300,
235236
'events' => (object) [
236237
'http://schemas.openid.net/event/backchannel-logout' => (object)[]
237238
],
@@ -245,6 +246,7 @@ public function provideTestVerifyLogoutTokenClaimsData(): array
245246
'sid' => 'fake-client-sid',
246247
'sub' => 'fake-client-sub',
247248
'iat' => time(),
249+
'exp' => time() + 300,
248250
'events' => (object) [
249251
'http://schemas.openid.net/event/backchannel-logout' => (object)[]
250252
],
@@ -256,6 +258,7 @@ public function provideTestVerifyLogoutTokenClaimsData(): array
256258
'iss' => 'fake-issuer',
257259
'aud' => [ 'fake-client-id', 'some-other-aud' ],
258260
'iat' => time(),
261+
'exp' => time() + 300,
259262
'events' => (object) [
260263
'http://schemas.openid.net/event/backchannel-logout' => (object)[]
261264
],
@@ -268,6 +271,7 @@ public function provideTestVerifyLogoutTokenClaimsData(): array
268271
'aud' => [ 'fake-client-id', 'some-other-aud' ],
269272
'sub' => 'fake-client-sub',
270273
'iat' => time(),
274+
'exp' => time() + 300,
271275
'events' => (object) [
272276
'http://schemas.openid.net/event/backchannel-logout' => (object)[]
273277
],
@@ -280,6 +284,7 @@ public function provideTestVerifyLogoutTokenClaimsData(): array
280284
'aud' => [ 'fake-client-id', 'some-other-aud' ],
281285
'sid' => 'fake-client-sid',
282286
'iat' => time(),
287+
'exp' => time() + 300,
283288
'events' => (object) [
284289
'http://schemas.openid.net/event/backchannel-logout' => (object)[]
285290
],
@@ -292,6 +297,7 @@ public function provideTestVerifyLogoutTokenClaimsData(): array
292297
'aud' => [ 'fake-client-id', 'some-other-aud' ],
293298
'sid' => 'fake-client-sid',
294299
'iat' => time(),
300+
'exp' => time() + 300,
295301
'events' => (object) [
296302
'http://schemas.openid.net/event/backchannel-logout' => (object)[]
297303
],
@@ -305,6 +311,7 @@ public function provideTestVerifyLogoutTokenClaimsData(): array
305311
'aud' => [ 'fake-client-id', 'some-other-aud' ],
306312
'sid' => 'fake-client-sid',
307313
'iat' => time(),
314+
'exp' => time() + 300,
308315
'nonce' => 'must-not-be-set'
309316
],
310317
false
@@ -315,6 +322,7 @@ public function provideTestVerifyLogoutTokenClaimsData(): array
315322
'aud' => [ 'fake-client-id', 'some-other-aud' ],
316323
'sid' => 'fake-client-sid',
317324
'iat' => time(),
325+
'exp' => time() + 300,
318326
'events' => (object) [],
319327
'nonce' => 'must-not-be-set'
320328
],
@@ -325,6 +333,7 @@ public function provideTestVerifyLogoutTokenClaimsData(): array
325333
'iss' => 'fake-issuer',
326334
'aud' => [ 'fake-client-id', 'some-other-aud' ],
327335
'sid' => 'fake-client-sid',
336+
'exp' => time() + 300,
328337
'events' => (object) [
329338
'http://schemas.openid.net/event/backchannel-logout' => (object)[]
330339
]
@@ -337,6 +346,34 @@ public function provideTestVerifyLogoutTokenClaimsData(): array
337346
'aud' => [ 'fake-client-id', 'some-other-aud' ],
338347
'sid' => 'fake-client-sid',
339348
'iat' => time() + 301,
349+
'exp' => time() + 300,
350+
'events' => (object) [
351+
'http://schemas.openid.net/event/backchannel-logout' => (object)[]
352+
]
353+
],
354+
false
355+
],
356+
'invalid-no-exp' => [
357+
(object)[
358+
'iss' => 'fake-issuer',
359+
'aud' => [ 'fake-client-id', 'some-other-aud' ],
360+
'sid' => 'fake-client-sid',
361+
'jti' => 'fake-client-jti',
362+
'iat' => time(),
363+
'events' => (object) [
364+
'http://schemas.openid.net/event/backchannel-logout' => (object)[]
365+
]
366+
],
367+
false
368+
],
369+
'invalid-bad-exp' => [
370+
(object)[
371+
'iss' => 'fake-issuer',
372+
'aud' => [ 'fake-client-id', 'some-other-aud' ],
373+
'sid' => 'fake-client-sid',
374+
'jti' => 'fake-client-jti',
375+
'iat' => time(),
376+
'exp' => time() - 300,
340377
'events' => (object) [
341378
'http://schemas.openid.net/event/backchannel-logout' => (object)[]
342379
]
@@ -357,4 +394,15 @@ public function provideTestVerifyLogoutTokenClaimsData(): array
357394
],
358395
];
359396
}
397+
398+
public function testLeeway()
399+
{
400+
// Default leeway is 300
401+
$client = new OpenIDConnectClient();
402+
$this->assertEquals(300, $client->getLeeway());
403+
404+
// Set leeway to 100
405+
$client->setLeeway(100);
406+
$this->assertEquals(100, $client->getLeeway());
407+
}
360408
}

0 commit comments

Comments
 (0)