如何验证用户JWT通过令牌传递是否正确

Question

My mean is not validate a correct format Token.

According to jwt/README.md at 3.2 · lcobucci/jwt This validate is validating a correct format Token, but when I set a value like http://example.org/token/123.123.123 ，this library will throw an exception, like this:

How to validate the user JWT pass over Token is correct with 2 dots?

Answer 1

I already have a solution, share to all:

// $token from a HTTP request.
// Must have 2 dots.
if (substr_count($token, '.') === 2) {
    $preValidToken = base64_decode($token);
    // Get decoded token's last '}' position.
    $lastPos = strrpos($preValidToken, '}');
    if ($lastPos) {
        // Assemble Json string.
        $preValidToken = '[' . substr($preValidToken, 0, $lastPos + 1) . ']';
        $preValidToken = str_replace('}{', '},{', $preValidToken);
        // Convert to associative array.
        $preValidToken = json_decode($preValidToken, true);
        if ($preValidToken && is_array($preValidToken)) {
            var_dump($preValidToken);
            die;
            $token = (new Parser())->parse((string) $token);
            // Parses from a string
            // Do something here...
        }
    }
}
echo json_encode([
    'code' => 205,
    'msg' => 'Token not valid '
]);
exit();

If valided, $preValidToken will be a array , content like this:

array (size=2)
  0 => 
    array (size=3)
      'typ' => string 'JWT' (length=3)
      'alg' => string 'HS256' (length=5)
      'jti' => string '123123123' (length=9)
  1 => 
    array (size=6)
      'iss' => string 'http://example.org' (length=13)
      'jti' => string '123123123' (length=9)
      'iat' => int 1524314239
      'nbf' => int 1524314299
      'exp' => int 1524317839
      'uid' => int 1

And then, we can verify that the token is valid through verifying this array, if no problem, we can execute next code line $token = (new Parser())->parse((string) $token); without error.

I do not know if there is a better way?

Answer 2

There's no need to pre-validate anything, because the library is giving you an exception; the purpose of exceptions is that they can be caught in order to handle the situation. So all you need is this:

try {
    $token_info = (new Parser())->parse((string) $token_string);
    // successful
} catch(RuntimeException $e) {
    // unsuccessful
}