Algorithm Not Allowed error with Firebase trying to decode JWT token

Question

I am having a lot of issues trying to decrypt a JWT token using php and Firebase

<?php

ini_set('display_errors', 1);
ini_set('display_startup_errors', 1);
error_reporting(E_ALL);

require 'vendor/autoload.php';

use \Firebase\JWT\JWT;

try {
    $key = 'MYKEY';
    $token = $_POST['id_token'];
    $data = JWT::decode($token, $key, array('HS256'));
} catch (\Exception $e) { 
    echo $e;
}

?>

Algorithm not allowed in JWT.php:97

Has anyone ever had this?

Paul

Answer 1

If I am not wrong, in recent versions of JWT the decode function requires a new parameter (allowed algorithms). Previously this was not required.

I use this to get all supported algorithms:

$decoded = JWT::decode($token, $key, array_keys(JWT::$supported_algs));

Answer 2

You should use the google keys to decode the token.

$googleKeysURL = 'https://www.googleapis.com/robot/v1/metadata/x509/securetoken@system.gserviceaccount.com';
$key = json_decode(file_get_contents($googleKeysURL), true);

$decoded = JWT::decode($token, $key, array("RS256"));

Also I was having a problem because of the server timezone so I add this before the decoding line:

JWT::$leeway = 600;