Skip to content

Correct jwt

Sebastien Marie requested to merge semarie/pasteque-server:correct-jwt into master

the following PR moves JWT to use HMAC instead of just a hash (RFC 7519 recommands using a MAC) and it makes JWT to check the signature using a timing-attack resistant function (hash_equals from PHP if available, or an alternative implementation).

Please note that the current use of == (instead of ===) could imply a security issue (auth bypass in specifics cases).

Merge request reports