the following PR moves JWT to use HMAC instead of just a hash (RFC 7519 recommands using a MAC) and it makes JWT to check the signature using a timing-attack resistant function (
hash_equals from PHP if available, or an alternative implementation).
Please note that the current use of
== (instead of
===) could imply a security issue (auth bypass in specifics cases).