From 97cac28f06b2af29eeaf176b7c49a260d4a74965 Mon Sep 17 00:00:00 2001 From: Brent Shaffer Date: Tue, 17 Oct 2023 12:07:19 -0700 Subject: [PATCH 1/2] fix: allowed_algs not properly set for string value --- src/OAuth2.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/OAuth2.php b/src/OAuth2.php index 3db54c769..2e5adcdcf 100644 --- a/src/OAuth2.php +++ b/src/OAuth2.php @@ -1723,7 +1723,7 @@ private function getFirebaseJwtKeys($publicKey, $allowedAlgs) $allowedAlg = null; if (is_string($allowedAlgs)) { - $allowedAlg = $allowedAlg; + $allowedAlg = $allowedAlgs; } elseif (is_array($allowedAlgs)) { if (count($allowedAlgs) > 1) { throw new \InvalidArgumentException( From 64ac6eb985e0554eeae27f457e96e52f31717c23 Mon Sep 17 00:00:00 2001 From: Brent Shaffer Date: Tue, 17 Oct 2023 12:13:10 -0700 Subject: [PATCH 2/2] add test --- tests/OAuth2Test.php | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/tests/OAuth2Test.php b/tests/OAuth2Test.php index 8de3f35b9..e00ab647f 100644 --- a/tests/OAuth2Test.php +++ b/tests/OAuth2Test.php @@ -1250,8 +1250,14 @@ public function testShouldReturnAValidIdToken() $alg = 'RS256'; $jwtIdToken = JWT::encode($origIdToken, $privateKey, $alg); $o->setIdToken($jwtIdToken); + + // Test with array alg $roundTrip = $o->verifyIdToken($publicKey, [$alg]); $this->assertEquals($origIdToken['aud'], $roundTrip->aud); + + // Test with string alg + $roundTrip2 = $o->verifyIdToken($publicKey, $alg); + $this->assertEquals($origIdToken['aud'], $roundTrip2->aud); } }