Skip to content

Commit 632a744

Browse files
samuelweisamuelwei
authored
Merge branch 'master' into fix-events-claim-check-on-backchannel-logout
2 parents 849f168 + bc719cc commit 632a744

File tree

3 files changed

+66
-4
lines changed

3 files changed

+66
-4
lines changed

‎CHANGELOG.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,12 +6,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
66

77
## [unreleased]
88

9+
### Added
10+
- Support to change the `leeway` time for JWT verification using `setLeeway` #483
11+
912
### Changed
1013
- Stop adding ?schema=openid to userinfo endpoint URL. #449
1114

1215
### Fixed
1316
- Check existence of subject when verifying JWT #474
1417
- Check existence of events claim when verifying Logout Token claims #480
18+
- exp verification when verifying Logout Token claims #482
1519

1620
## [1.0.1] - 2024-09-13
1721

‎src/OpenIDConnectClient.php‎

Lines changed: 14 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -539,12 +539,17 @@ public function verifyLogoutTokenClaims($claims): bool
539539
if (!in_array($this->clientID, $auds, true)) {
540540
return false;
541541
}
542-
// Validate the iat. At this point we can return true if it is ok
543-
if (isset($claims->iat) && ((is_int($claims->iat)) && ($claims->iat <= time() + $this->leeway))) {
544-
return true;
542+
// Validate iat exists, is an int, and is not in the future
543+
if (!isset($claims->iat) || !is_int($claims->iat) || ($claims->iat >= time() + $this->leeway)) {
544+
return false;
545545
}
546546

547-
return false;
547+
// Validate exp exists, is an int, and is not too old
548+
if (!isset($claims->exp) || !is_int($claims->exp) || ($claims->exp <= time() - $this->leeway)) {
549+
return false;
550+
}
551+
552+
return true;
548553
}
549554

550555
/**
@@ -2033,6 +2038,11 @@ public function getLeeway(): int
20332038
return $this->leeway;
20342039
}
20352040

2041+
public function setLeeway(int $leeway)
2042+
{
2043+
$this->leeway = $leeway;
2044+
}
2045+
20362046
/**
20372047
* @return string
20382048
*/

‎tests/OpenIDConnectClientTest.php‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -225,6 +225,7 @@ public function provideTestVerifyLogoutTokenClaimsData(): array
225225
'sid' => 'fake-client-sid',
226226
'sub' => 'fake-client-sub',
227227
'iat' => time(),
228+
'exp' => time() + 300,
228229
'events' => (object) [
229230
'http://schemas.openid.net/event/backchannel-logout' => (object)[]
230231
],
@@ -238,6 +239,7 @@ public function provideTestVerifyLogoutTokenClaimsData(): array
238239
'sid' => 'fake-client-sid',
239240
'sub' => 'fake-client-sub',
240241
'iat' => time(),
242+
'exp' => time() + 300,
241243
'events' => (object) [
242244
'http://schemas.openid.net/event/backchannel-logout' => (object)[]
243245
],
@@ -249,6 +251,7 @@ public function provideTestVerifyLogoutTokenClaimsData(): array
249251
'iss' => 'fake-issuer',
250252
'aud' => [ 'fake-client-id', 'some-other-aud' ],
251253
'iat' => time(),
254+
'exp' => time() + 300,
252255
'events' => (object) [
253256
'http://schemas.openid.net/event/backchannel-logout' => (object)[]
254257
],
@@ -261,6 +264,7 @@ public function provideTestVerifyLogoutTokenClaimsData(): array
261264
'aud' => [ 'fake-client-id', 'some-other-aud' ],
262265
'sub' => 'fake-client-sub',
263266
'iat' => time(),
267+
'exp' => time() + 300,
264268
'events' => (object) [
265269
'http://schemas.openid.net/event/backchannel-logout' => (object)[]
266270
],
@@ -273,6 +277,7 @@ public function provideTestVerifyLogoutTokenClaimsData(): array
273277
'aud' => [ 'fake-client-id', 'some-other-aud' ],
274278
'sid' => 'fake-client-sid',
275279
'iat' => time(),
280+
'exp' => time() + 300,
276281
'events' => (object) [
277282
'http://schemas.openid.net/event/backchannel-logout' => (object)[]
278283
],
@@ -285,6 +290,7 @@ public function provideTestVerifyLogoutTokenClaimsData(): array
285290
'aud' => [ 'fake-client-id', 'some-other-aud' ],
286291
'sid' => 'fake-client-sid',
287292
'iat' => time(),
293+
'exp' => time() + 300,
288294
'events' => (object) [
289295
'http://schemas.openid.net/event/backchannel-logout' => (object)[]
290296
],
@@ -298,6 +304,7 @@ public function provideTestVerifyLogoutTokenClaimsData(): array
298304
'aud' => [ 'fake-client-id', 'some-other-aud' ],
299305
'sid' => 'fake-client-sid',
300306
'iat' => time(),
307+
'exp' => time() + 300,
301308
],
302309
false
303310
],
@@ -307,6 +314,7 @@ public function provideTestVerifyLogoutTokenClaimsData(): array
307314
'aud' => [ 'fake-client-id', 'some-other-aud' ],
308315
'sid' => 'fake-client-sid',
309316
'iat' => time(),
317+
'exp' => time() + 300,
310318
'events' => (object) [],
311319
],
312320
false
@@ -316,6 +324,7 @@ public function provideTestVerifyLogoutTokenClaimsData(): array
316324
'iss' => 'fake-issuer',
317325
'aud' => [ 'fake-client-id', 'some-other-aud' ],
318326
'sid' => 'fake-client-sid',
327+
'exp' => time() + 300,
319328
'events' => (object) [
320329
'http://schemas.openid.net/event/backchannel-logout' => (object)[]
321330
]
@@ -328,6 +337,34 @@ public function provideTestVerifyLogoutTokenClaimsData(): array
328337
'aud' => [ 'fake-client-id', 'some-other-aud' ],
329338
'sid' => 'fake-client-sid',
330339
'iat' => time() + 301,
340+
'exp' => time() + 300,
341+
'events' => (object) [
342+
'http://schemas.openid.net/event/backchannel-logout' => (object)[]
343+
]
344+
],
345+
false
346+
],
347+
'invalid-no-exp' => [
348+
(object)[
349+
'iss' => 'fake-issuer',
350+
'aud' => [ 'fake-client-id', 'some-other-aud' ],
351+
'sid' => 'fake-client-sid',
352+
'jti' => 'fake-client-jti',
353+
'iat' => time(),
354+
'events' => (object) [
355+
'http://schemas.openid.net/event/backchannel-logout' => (object)[]
356+
]
357+
],
358+
false
359+
],
360+
'invalid-bad-exp' => [
361+
(object)[
362+
'iss' => 'fake-issuer',
363+
'aud' => [ 'fake-client-id', 'some-other-aud' ],
364+
'sid' => 'fake-client-sid',
365+
'jti' => 'fake-client-jti',
366+
'iat' => time(),
367+
'exp' => time() - 300,
331368
'events' => (object) [
332369
'http://schemas.openid.net/event/backchannel-logout' => (object)[]
333370
]
@@ -336,4 +373,15 @@ public function provideTestVerifyLogoutTokenClaimsData(): array
336373
],
337374
];
338375
}
376+
377+
public function testLeeway()
378+
{
379+
// Default leeway is 300
380+
$client = new OpenIDConnectClient();
381+
$this->assertEquals(300, $client->getLeeway());
382+
383+
// Set leeway to 100
384+
$client->setLeeway(100);
385+
$this->assertEquals(100, $client->getLeeway());
386+
}
339387
}

0 commit comments

Comments
 (0)