googleapis/php-jwt
View on GitHub ↗ ★ 9,803 PHP
PHP package for JWT
7 mentions on Hacker News by 4 people: 1 story, 6 comments · first 2015-04-01 · latest 2025-09-01
20082026
-
…JWT vulnerability. Prior art: https://auth0.com/blog/critical-vulnerabilities-in-json-web-... https://github.com/firebase/php-jwt/issues/351 You should really consider not using JWT for new designs that don't a priori need to interop with…
comment by some_furry · 2025-09-01 · in Using JWT to establish a trusted context for Row Level Security -
https://github.com/firebase/php-jwt/issues/351
comment by CiPHPerCoder · 2024-05-27 · in Should I use JWTs for authentication tokens? -
The vulnerability is usually in verifiers rather than signers. See, for example: https://github.com/firebase/php-jwt/issues/351
comment by CiPHPerCoder · 2024-05-27 · in Should I use JWTs for authentication tokens? -
…publicly accessible. This doesn't involve private keys at all. Look at the proof of concept code. https://github.com/firebase/php-jwt/files/6966712/php-jwt-po...
comment by CiPHPerCoder · 2021-08-25 · in API Tokens: A Tedious Survey -
…shortly, JWT is a gun aimed directly at your foot. That's why there's so much hate for JWTs. [1] https://github.com/firebase/php-jwt/issues/351 [2] https://paragonie.com/blog/2017/03/jwt-json-web-tokens-is-ba... [3]…
comment by CiPHPerCoder · 2021-08-24 · in API Tokens: A Tedious Survey -
▲ 4
Firebase/PHP-JWT: New Risk of HS256/RSA256 Algorithm Confusionstory by paragon_init · 2021-08-04 · 0 comments
-
…as vulnerable but I can't see why. As far as I can see they do not support the None algorithm. https://github.com/firebase/php-jwt/blob/master/Authenticati... It's not in the methods array and the decode method specifically does a check to…
comment by mfjordvald · 2015-04-01 · in Critical Vulnerabilities in JSON Web Token Libraries