web-token/jwt-framework

View on GitHub

JWT Framework

Is web-token/jwt-framework beginner-friendly?

The maintainers of web-token/jwt-framework usually reply to a pull request within 1 day. No beginner-friendly issue is open right now; the list below has the other issues we hold for it.

Stars: 954
Forks: 119
Open beginner issues: 0
Indexed issues: 23
Avg merge: 48m
Merged PRs (30d): 17

Dominant language: PHP
License: MIT
Last GitHub push: Sep 13, 2026
Latest indexed: Oct 13, 2026
Contributing guide: No contributing guide
Code of conduct: No code of conduct
Beginner labels: No beginner labels indexed

How to contribute to web-token/jwt-framework

There is no contributing guide, so start from the README and a few recently merged pull requests to see how changes are proposed.
Your contributions will be published under the project's MIT license.
Follow the repository to hear when a new beginner-friendly issue opens, or look through the other issues below.

Beginner friendly Everything

Open All

Issues somebody may already be working on are listed last. List everything by date

SD-JWT: DisclosureProcessor has no depth bound, and chained Disclosures make memory grow quadratically
Open
- Is something wrong?
bug

Difficulty 3/5 1-2 days Newbie friendliness 68/100

web-token/jwt-framework#773 · Opened Nov 8, 2026

Maintainers usually reply within 1 day
SD-JWT: SDJWTIssuer lets a "_sd" member through in values that are not PHP arrays
Open
- Is something wrong?
bug

Difficulty 4/5 3-5 days Newbie friendliness 57/100

web-token/jwt-framework#772 · Opened Nov 8, 2026

Maintainers usually reply within 1 day
AES Key Wrap based algorithms unwrap an encrypted key of any length before comparing it with the CEK size
Open
- Is something wrong?
enhancement

Difficulty 4/5 3-5 days Newbie friendliness 55/100

web-token/jwt-framework#771 · Opened Nov 8, 2026

Maintainers usually reply within 1 day
ECDH-SS reads the "epk" header parameter when the key being tried is a private key
Open
- Is something wrong?
bug

Difficulty 4/5 3-5 days Newbie friendliness 48/100

web-token/jwt-framework#770 · Opened Nov 8, 2026

Maintainers usually reply within 1 day
Bundle: an application service tagged with an alias the bundle already uses is replaced by the bundle's service
Open
- Is something wrong?
bug

Difficulty 4/5 3-5 days Newbie friendliness 45/100

web-token/jwt-framework#769 · Opened Nov 8, 2026

Maintainers usually reply within 1 day
JWELoaderFactory and JWSLoaderFactory ignore the requested header checkers when they have no HeaderCheckerManagerFactory
Open
- Is something wrong?
bug

Difficulty 3/5 1-2 days Newbie friendliness 56/100

web-token/jwt-framework#768 · Opened Nov 8, 2026

Maintainers usually reply within 1 day
CallableChecker accepts any truthy result of its callable since 4.1.8
Open
- Is something wrong?
bug

Difficulty 3/5 1-2 days Newbie friendliness 76/100

web-token/jwt-framework#767 · Opened Nov 8, 2026

Maintainers usually reply within 1 day
Base64UrlSafe accepts bytes 0x80 to 0xFF when ext-sodium is loaded
Open
- Is something wrong?
bug

Difficulty 3/5 1-2 days Newbie friendliness 76/100

web-token/jwt-framework#766 · Opened Nov 8, 2026

Maintainers usually reply within 1 day
SD-JWT: VerifiedSDJWT::getIssuerSignedJwt() keeps the signatures the loader did not verify
Open
- Is something wrong?
bug

Difficulty 3/5 1-2 days Newbie friendliness 55/100

web-token/jwt-framework#765 · Opened Nov 8, 2026

Maintainers usually reply within 1 day
X5UFactory: an x5u entry can name a local file
Open
- Is something wrong?
bug

Difficulty 3/5 1-2 days Newbie friendliness 69/100

web-token/jwt-framework#764 · Opened Nov 8, 2026

Maintainers usually reply within 1 day
The deprecated key set cache of JKUFactory and X5UFactory ignores the request headers
Open
- Is something wrong?
bug

Difficulty 3/5 1-2 days Newbie friendliness 65/100

web-token/jwt-framework#763 · Opened Nov 8, 2026

Maintainers usually reply within 1 day
JKUFactory and X5UFactory follow HTTP redirects when they fetch a key set
Open
- Is something wrong?
enhancement

Difficulty 4/5 3-5 days Newbie friendliness 48/100

web-token/jwt-framework#762 · Opened Nov 8, 2026

Maintainers usually reply within 1 day
KeyChecker: "key_ops" does not tell content decryption from key unwrapping, and "deriveKey"/"deriveBits" are not accepted on both sides
Open
- Is something wrong?
enhancement

Difficulty 4/5 3-5 days Newbie friendliness 48/100

web-token/jwt-framework#761 · Opened Nov 8, 2026

Maintainers usually reply within 1 day
Hardening: refuse a JSON "dir" JWE without protected header and "aad", whose content can be an A*GCMKW encrypted key
Open
- Is something wrong?
enhancement

Difficulty 4/5 3-5 days Newbie friendliness 48/100

web-token/jwt-framework#760 · Opened Nov 8, 2026

Maintainers usually reply within 1 day
AES-CBC-HMAC: AL covers the protected header only, so the tag of a JWE with an "aad" member does not follow RFC 7518
Open
- Is something wrong?
bug

Difficulty 3/5 1-2 days Newbie friendliness 58/100

web-token/jwt-framework#759 · Opened Nov 8, 2026

Maintainers usually reply within 1 day
Bundle: checker lists of one service defined in two configurations are merged by position, and a checker is silently lost
Open
- Is something wrong?
bug

Difficulty 4/5 3-5 days Newbie friendliness 48/100

web-token/jwt-framework#758 · Opened Nov 8, 2026

Maintainers usually reply within 1 day
NestedTokenLoader: read "cty" from the JWE protected header only
Open
- Is something wrong?
enhancement

Difficulty 2/5 1-3 hours Newbie friendliness 74/100

web-token/jwt-framework#757 · Opened Nov 8, 2026

Maintainers usually reply within 1 day
Claim and header checker managers silently keep only the last checker of a claim or header parameter
Open
- Is something wrong?
bug

Difficulty 4/5 3-5 days Newbie friendliness 42/100

web-token/jwt-framework#756 · Opened Nov 8, 2026

Maintainers usually reply within 1 day
5.0.0: remove what 4.3 deprecated, seal what it announced
May be free again @Spomky claimed this 56 days ago, and no pull request is open. Open
- Is something wrong?
enhancement

web-token/jwt-framework#717 · 1 assignee · Opened Aug 29, 2026

Maintainers usually reply within 1 day
RSA1_5: pass the expected CEK size as a parameter instead of the hardcoded CEK_LENGTHS table
May be free again @Spomky claimed this 72 days ago, and no pull request is open. Open
- Is something wrong?
enhancement

web-token/jwt-framework#653 · 1 comment · 1 assignee · Opened Jun 6, 2026

Maintainers usually reply within 1 day
feat(encryption): HPKE for JWE (draft-ietf-jose-hpke-encrypt, awaiting AD go-ahead)
Possibly taken @Spomky claimed this 56 days ago. Open
- Is something wrong?
Compliance feature

web-token/jwt-framework#729 · 1 assignee · Opened Sep 12, 2026

Maintainers usually reply within 1 day

web-token/jwt-framework

Is web-token/jwt-framework beginner-friendly?

How to contribute to web-token/jwt-framework

Is something wrong?

Is something wrong?

Is something wrong?

Is something wrong?

Is something wrong?

Is something wrong?

Is something wrong?

Is something wrong?

Is something wrong?

Is something wrong?

Is something wrong?

Is something wrong?

Is something wrong?

Is something wrong?

Is something wrong?

Is something wrong?

Is something wrong?

Is something wrong?

Is something wrong?

Is something wrong?

Is something wrong?

Get new issues in your inbox